Upgrade to v3 : Resource not accessible by integration

[RobinMaronier]

Hi @mheap,

When i'm upgrading action to v3 from v2, I have the error Resource not accessible by integration. Everything works fine with v1 & v2.
Did I miss something ?

Thanks !!

[QcFe]

Same issue here...

[mheap]

Could you both please link to the workflow that you're using?

[QcFe]

Mine is currently on a private repository (that will be made public in a while but I cannot open it right now). Here's the workflow:

name: Checks
on:
  push:
    branches:
      - main
      - develop
  pull_request:
    types:
      - opened
      - labeled
      - unlabeled
jobs:
  label: 
    name: Ensure PR not in hold
    runs-on: ubuntu-latest
    steps:
      - name: Check
        uses: mheap/github-action-required-labels@v3
        with:
          mode: exactly
          count: 0
          labels: "pr-hold"

I attach the output from the action:

Using v2 works correctly (apart from the set-output notice from github).

[RobinMaronier]

Hi !
Private repo as well 😕

name: Mandatory labels

on:
  pull_request:
    types: [ labeled, unlabeled, opened, edited, synchronize ]

jobs:
  label:
    runs-on: ubuntu-latest
    steps:
      - uses: mheap/github-action-required-labels@v3
        with:
          mode: minimum
          count: 1
          labels: "xx"

[mheap]

I can't seem to reproduce the issue.

Workflow: https://github.com/mheap/label-test-repo/blob/main/.github/workflows/label.yml

Output without pr-hold label: https://github.com/mheap/label-test-repo/actions/runs/4575296239/jobs/8077954466
Output with pr-hold label: https://github.com/mheap/label-test-repo/actions/runs/4575311358

[QcFe]

Then I guess it could happen in case of private repos? I can't see any other difference at this point...

[mheap]

Found the issue. The github.token used to have implicit permissions and it no longer does.

Here's a workflow that worked for me with a private repo:

name: Checks
on:
  push:
    branches:
      - main
      - develop
  pull_request:
    types:
      - opened
      - labeled
      - unlabeled
jobs:
  label: 
    name: Ensure PR not in hold
    runs-on: ubuntu-latest
    permissions:
      issues: read
      pull-requests: read
    steps:
      - name: Check
        uses: mheap/github-action-required-labels@v3
        with:
          mode: exactly
          count: 0
          labels: "pr-hold"

[ockham]

I was just facing a similar issue in our repo. FWIW, the docs on GHA permissions state:

issues: Work with issues. For example, issues: write permits an action to add a comment to an issue.
pull-requests: Work with pull requests. For example, pull-requests: write permits an action to add a label to a pull request.

This means that the suggested workaround

    permissions:
      issues: read
      pull-requests: read

won't work with add_comment set to true, right?

@mheap Would it make sense to document in the README that if people want the action to post comments to their PRs and issues, they'll need to provide a token that has write permissions for issues and PRs?

[mheap]

@ockham The README documents the following in the examples:

    permissions:
      issues: write
      pull-requests: write

What would you expect to see in addition?