Example code does not properly grant permissions for opening PullRequests

[kastl-ars]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The example does contain sample code for allowing the action to open up a Pull Request. However, it seems to not be working (anymore).

permissions:
  contents: write
  pull-requests: write

jobs:
  updatecli:
[...]

In my test repository, using the "default" token available in the workflow, the action was allowed to create a new branch, but not a pull request.

ERROR: running actions failed: errors occurred while running actions:
	* creating pull request: GitHub Actions is not permitted to create or approve pull requests

Expected Behavior

The example configuration should be usable "as is" and contain code that securely allows the action to open up pull requests.

If this is not possible, the README should explain how to do this, i.e. which permissions are needed or should be left out etc.

Anything else?

Kind Regards,
Johannes

[kastl-ars]

The documentation does not elaborate on thepull-requests permission used in the example:

Work with pull requests. For example, `pull-requests: write` permits an action to add a label to a pull request. For more information, see [Permissions required for GitHub Apps](https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-pull-requests).

[kastl-ars]

Hmm, could it be that the action definition inside my updatecli.yaml is not in sync with the action setup and thus has no permissions to create the pull request?

But why would it be allowed to create a branch, then?

[kastl-ars]

Hmm, could it be that the action definition inside my updatecli.yaml is not in sync with the action setup and thus has no permissions to create the pull request?

I tried variations of different token or username settings, but the error still persists. The branch can be created, but not the pull request.

[kastl-ars]

I asked in the updatecli discussions and was pointed at the repository settings that need to be adjusted in addition to the permissions in the example:

Go to Repository Settings → Actions → General → Workflow permissions and enable Allow GitHub Actions to create and approve pull requests.

I am currently testing this.