mirror of
https://github.com/actions/labeler.git
synced 2025-12-11 20:24:51 +00:00
Compare commits
2 Commits
v6.0.1
...
Permission
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
38922d90b5 | ||
|
|
e7d9c02dc8 |
@@ -256,11 +256,17 @@ jobs:
|
|||||||
# Put your commands for running backend tests here
|
# Put your commands for running backend tests here
|
||||||
```
|
```
|
||||||
|
|
||||||
## Permissions
|
## Recommended Permissions
|
||||||
|
|
||||||
In order to add labels to pull requests, the GitHub labeler action requires write permissions on the pull-request. However, when the action runs on a pull request from a forked repository, GitHub only grants read access tokens for `pull_request` events, at most. If you encounter an `Error: HttpError: Resource not accessible by integration`, it's likely due to these permission constraints. To resolve this issue, you can modify the `on:` section of your workflow to use
|
In order to add labels to pull requests, the GitHub labeler action requires write permissions on the pull-request. However, when the action runs on a pull request from a forked repository, GitHub only grants read access tokens for `pull_request` events, at most. If you encounter an `Error: HttpError: Resource not accessible by integration`, it's likely due to these permission constraints. To resolve this issue, you can modify the `on:` section of your workflow to use
|
||||||
[`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) instead of `pull_request` (see example [above](#create-workflow)). This change allows the action to have write access, because `pull_request_target` alters the [context of the action](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) and safely grants additional permissions. Refer to the [GitHub token permissions documentation](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) for more details about access levels and event contexts.
|
[`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) instead of `pull_request` (see example [above](#create-workflow)). This change allows the action to have write access, because `pull_request_target` alters the [context of the action](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) and safely grants additional permissions. Refer to the [GitHub token permissions documentation](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) for more details about access levels and event contexts.
|
||||||
|
|
||||||
|
```yml
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
pull-requests: write
|
||||||
|
```
|
||||||
|
|
||||||
## Notes regarding `pull_request_target` event
|
## Notes regarding `pull_request_target` event
|
||||||
|
|
||||||
Using the `pull_request_target` event trigger involves several peculiarities related to initial set up of the labeler or updating version of the labeler.
|
Using the `pull_request_target` event trigger involves several peculiarities related to initial set up of the labeler or updating version of the labeler.
|
||||||
|
|||||||
2
dist/index.js
vendored
2
dist/index.js
vendored
@@ -1087,7 +1087,7 @@ function labeler() {
|
|||||||
error.message !== 'Resource not accessible by integration') {
|
error.message !== 'Resource not accessible by integration') {
|
||||||
throw error;
|
throw error;
|
||||||
}
|
}
|
||||||
core.warning(`The action requires write permission to add labels to pull requests. For more information please refer to the action documentation: https://github.com/actions/labeler#permissions`, {
|
core.warning(`The action requires write permission to add labels to pull requests. For more information please refer to the action documentation: https://github.com/actions/labeler#recommended-permissions`, {
|
||||||
title: `${process.env['GITHUB_ACTION_REPOSITORY']} running under '${github.context.eventName}' is misconfigured`
|
title: `${process.env['GITHUB_ACTION_REPOSITORY']} running under '${github.context.eventName}' is misconfigured`
|
||||||
});
|
});
|
||||||
core.setFailed(error.message);
|
core.setFailed(error.message);
|
||||||
|
|||||||
@@ -72,7 +72,7 @@ async function labeler() {
|
|||||||
}
|
}
|
||||||
|
|
||||||
core.warning(
|
core.warning(
|
||||||
`The action requires write permission to add labels to pull requests. For more information please refer to the action documentation: https://github.com/actions/labeler#permissions`,
|
`The action requires write permission to add labels to pull requests. For more information please refer to the action documentation: https://github.com/actions/labeler#recommended-permissions`,
|
||||||
{
|
{
|
||||||
title: `${process.env['GITHUB_ACTION_REPOSITORY']} running under '${github.context.eventName}' is misconfigured`
|
title: `${process.env['GITHUB_ACTION_REPOSITORY']} running under '${github.context.eventName}' is misconfigured`
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user