Permissions issue with forks (public repositories)

[mattstratton]

I'm a little confused by this portion By default, pull requests from a fork does not have "write" permissions when running in GitHub Actions, and those Pull Requests can not be approved or labeled.

We have a public repo with the GH action enabled. It works fine with my pull requests (branches in the repo). On PRs from forks, we get the error:
Error: Codeball Labeler failed to access GitHub. Check the "GITHUB_TOKEN Permissions" of this job and make sure that the job has WRITE permissions to Pull Requests.

Everything I can see makes it seem that is only the case for private repos: I have the job configured for permissions: write-all so I don't quite understand how to get this to work.

[mattstratton]

The repository is devopsdays/devopsdays-web

[zegl]

Hey @mattstratton! Cool to see that you've setup Codeball for devopsdays! 🧠

Permissions across forks can indeed be a bit tricky. By default, GitHub does not grant write access to the parent repository for actions run in a fork (and reasonably so).

Beware that there is a risk involved in granting write permissions to Pull Requests created from a fork (the token generated has write permissions after all).

You can go to the repository settings (at https://github.com/devopsdays/devopsdays-web/settings/actions) and flip some settings (see screenshot below) to make it work. If you can't see the settings, go and check the org settings first (at https://github.com/organizations/devopsdays/settings/actions).

GitHub documents this and more related to permissions for GitHub actions here.

When setup correctly, the settings should look like this:

We've also been thinking about alternative ways to grant permissions to approve PRs from forks, so please let me know if this doesn't work out, and we can test some alternative setups together.

[mattstratton]

Hmm. That's how we have them set up already (granted, it only requires approval from first time contributors, which seems more lenient than your example, but I could try that...I'm worried it will be annoying in our use case where 98% of the PRs come from forks and there are several per week)

[zegl]

Oh, I noticed now that there is a org setting about forwarding WRITE tokens to forks of private repositories, but nothing about public repositories...

The idea that we've had to work around this issue is to allow to install a GitHub App on the parent repository, and use the token of the application in this situation instead of using the token from the Action.

It makes the installation a bit more complicated, but it should work in more cases.

[zmstone]

Having the same issue, for PRs sent from forks, codeball does not have permission.

The idea that we've had to work around this issue is to allow to install a GitHub App on the parent repository, and use the token of the application in this situation instead of using the token from the Action.

Not sure if I follow, have I done it right as below ?

[zegl]

Not sure if I follow, have I done it right as below ?

We haven't built it yet, but maybe it's time! ;-D

[ngalaiko]

Hi @mattstratton @zmstone,

We've just published v2.2.0 of the action to address this issue.

Now, for cases as such, you can install Codeball AI Writer action to your repo, and then we'll use application installation tokens to approve/label pull request from our servers.

[ngalaiko]

Closing this one. Feel free to reopen if something doesn't work for you