Pushing commits to a PR with github actions

[sbanoseg]

Hello team, I was wondereing if you can help my out to figure out a problem I have to push a commit to a PR with github actions, currently I need to evaluate if a path was affected every time a commit is pushed into a PR, if this condition comes true, I need to push another commit with github actions including some changes in the same PR.

I have tried to find out some examples but I haven't found anything, is there something you can help me with.

[airtower-luna]

The actions/checkout documentation has an example of how to push in a workflow.

The fact that you want to push to a PR makes it a bit more complicated:

• You need to make sure that you check out the head branch, not the temporary merge commit that github.ref points at for pull_request events. Otherwise you get a weird history that you probably don't want. 😉

• Workflows started by pull_request events from forks get only read-only access to your repository, so they can't push. There are ways around that but they require special care for security, so I'll just point at this blog post from the GitHub security team about the matter.

[amithm7]

Workflows started by pull_request events from forks get only read-only access to your repository, so they can't push.

Are you absolutely sure?

If a PR comes from, say fork/patch-1, shouldn't it be writable if the action is running the in the fork's context (and also using fork's workflow file)?

[airtower-luna]

pull_request events run in the context of the target repository, and they definitely won't be able to push there.

I haven't checked what happens if the PR author has checked the box to allow people with write access to the target branch to push to the PR branch. But I'd be surprised if it'd work, after all the token for the pull_request event can't push to the target.

[amithm7]

pull_request events run in the context of the target repository, and they definitely won't be able to push there.

You mean the base repository?

Yes, no reason a PR coming from a fork (and it's potentially modified workflow file) should be able to push to the base repository.

But it should be able to push back to the fork, right?

[amithm7]

Haven't found any way with pull_request workflow, which will be a "Fork Pull Request Workflow" in this case as it is coming from a fork. (Workflow file from PR's HEAD / fork will be used to run action on original repo., and will have only read-only GITHUB_TOKEN)

Even in private repos which can have GITHUB_TOKEN with write access (Send write tokens to workflows from pull requests) are only able to write to original repo instead of the fork repo.

pull_request_target may be the only option currently. It does come with a warning of checking out the fork repo.