What GitHub Actions permissions does Release Drafter Need

[RehanSaeed]

GitHub has released new permissions for GitHub actions. You can make a repo/organisation default to minimal read only permissions by default which causes release drafter to stop working. What permissions does release deafter need?

https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/

[jetersen]

Your welcome to experiment 😅

I presume contents write and pull request read

[RehanSaeed]

That worked, thanks!

permissions:
      contents: write
      pull-requests: read

[RehanSaeed]

Looks autolabeler stops working if I use:

permissions:
  contents: write
  pull-requests: read

Trying to work out what I need to add to get that to work.

[jetersen]

You most likely need pull-requests write to add labels

[RehanSaeed]

Tried that but it didn't seem to do the trick.

https://github.com/RehanSaeed/FastestNuGet/blob/main/.github/workflows/release-drafter.yml

[jetersen]

Did you try to add issues: read or write?

[RehanSaeed]

I tried permissions: write-all and it still didn't work for some reason. Not sure what's wrong.

[jetersen]

maybe labels are not covered by their current permission scheme

[jetersen]

@RehanSaeed was this successful?

[RehanSaeed]

Almost. Auto labelling is still broken even if I give full permissions.

[jetersen]

Might be an issue for GitHub? I don't feel comfortable suggesting this unless it also works for auto labeling.

[martinda]

I tried the permissions mentioned above but the Error: Resource not accessible by integration gets thrown every time. Then I looked at the effective GITHUB_TOKEN permission values in the workflow run, and all the permissions are set to read regardless of anything I specify in the yml file or in the Settings... Actions... Workflow Permissions config page. In this blog post, Github says that:

Pull requests from public forks are still considered a special case and will receive a read token regardless of these settings.

That might explain why it keeps failing. I wonder how projects that use the release drafter work around this.

[gilbertsoft]

I tried the permissions mentioned above but the Error: Resource not accessible by integration gets thrown every time. Then I looked at the effective GITHUB_TOKEN permission values in the workflow run, and all the permissions are set to read regardless of anything I specify in the yml file or in the Settings... Actions... Workflow Permissions config page. In this blog post, Github says that:

Pull requests from public forks are still considered a special case and will receive a read token regardless of these settings.

That might explain why it keeps failing. I wonder how projects that use the release drafter work around this.

To enable write permissions for forks use the event pull_request_target instead of pull_request see https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#pull_request_target

[RehanSaeed]

@gilbertsoft I tried pull_request_target here with the permissions below and found that auto labelling still doesn't work. Not sure what else I'm missing.

permissions:
contents: write
pull-requests: write