[BUG] When running in a workflow generated by a dependabot BUMP PR, the action fails

[kpturner]

Is there an existing issue for this?

• I have searched the existing issues

Does this issue exist in the latest version?

• I'm using the latest release

Describe the bug?

When dependabot creates a PR to bump a package, calls to this action results in one of two errors

  Resolving repository path...
  Setting up 'temp_changed_files' remote...
  No 'temp_changed_files' remote found
  Creating 'temp_changed_files' remote...
  error: remote temp_changed_files already exists.
  Error: Process completed with exit code 3.

or

 Resolving repository path...
 Setting up 'temp_changed_files' remote...
 No 'temp_changed_files' remote found
 Creating 'temp_changed_files' remote...
 Getting HEAD info...
 fatal: could not read Password for 'https://***@github.com': No such device or address
 Error: Process completed with exit code 128.

To Reproduce

Simply create a workflow that triggers on Pull Requests and uses tj-actions/changed-files@v11.7

If dependabot creates the PR, then the action fails.

What OS are you seeing the problem on?

ubuntu-latest or ubuntu-20.04

Expected behavior?

Should work just the same as if a normal user created a PR

Relevant log output

See above

Anything else?

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

Thanks for reporting this issue.

[jackton1]

That’s due to the fact that dependabot doesn’t have access to your GitHub secrets. I’ll suggest using github.token.

See: https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/

[kpturner]

Which of the two issues do you mean?

I am now getting this even on PRs that are not created by dependabot

  Resolving repository path...
  Setting up 'temp_changed_files' remote...
  No 'temp_changed_files' remote found
  Creating 'temp_changed_files' remote...
  error: remote temp_changed_files already exists.
  Error: Process completed with exit code 3.

[jackton1]

Can you post the code that you currently have running

[kpturner]

      - name: Check file changes
        id: changed-files-specific
        uses: tj-actions/changed-files@v11.7
        with:
          files: |
            common/apps/ui

It is weird because this was working OK. It is like something has gone pear-shaped on the remote as a result of the dependabot runs. Is this creating a fiel on the remote?

[jackton1]

If the errors are for the dependabot PR’s I’ll recommend re-running them manually. The less secure option would be to change the event to pull_request_target.

Long term recommendation: Skip steps that don’t need to run when dependabot PR’s are created or taking a look at renovate bot which doesn’t run into the same issue.

[kpturner]

As I said, I am now getting this error with my own push and pull requests. Not via dependabot.

[jackton1]

Did something change on your main branch ?

You might have to use fetch-depth: 0 with the checkout action.

[kpturner]

Yeah I have that

      - name: Checkout repo
        uses: actions/checkout@v1
        with:
          lfs: true
          fetch-depth: 0

      - name: Check file changes
        id: changed-files-specific
        uses: tj-actions/changed-files@v11.7
        with:
          files: |
            common/apps/ui
       

[kpturner]

Weird - pushed another random change it it started working again.

So back to dependabot, what would the recommendation be again?

[jackton1]

#268 (comment)

[kpturner]

I will just skip the tests - which is a bit annoying because I have loads of checks, so they all appear (for each dependabot PR) as skipped when I would rather not see them at all. Anyway, thanks for the help.

[kpturner]

Sorry but will have to re-open this. Is still get this randomly on workflows that are triggered by me. When I make a "push" I get several workflows triggered at once. Since they run on different runners, it is entirely possible that two or more workflows run simultaneously on the same repo. I then get this:

 Resolving repository path...
  Setting up 'temp_changed_files' remote...
  No 'temp_changed_files' remote found
  Creating 'temp_changed_files' remote...
  error: remote temp_changed_files already exists.
  Error: Process completed with exit code 3.

[jackton1]

Can you get all related log information that can be used to debug this as it's unclear from the error message you posted above

[kpturner]

logs_1605.zip

[jackton1]

@kpturner This should be resolved in the latest release

[kpturner]

Long term recommendation: Skip steps that don’t need to run when dependabot PR’s are created or taking a look at renovate bot which doesn’t run into the same issue.

I am wondering how renovate avoids running into the same issue. Certainly when I use renovate the GitHub Action Workflows that run as checks all still fail for the same reason. When the workflow tries to checkout a private action using checkout@v2 it provides a PAT that is stored as an Organization Secret. The renovate PRs fail because they have no access to the secret. Is it by configuring assignees?