rstudio/hex-stickers

rendering README in GHA on PR when comes from a fork does not work

Closed this issue · 5 comments

cderv commented

We encountered this here #60 and #61. (logs are probably not there anymore).

In both cases, it came from a fork. The issue is related to the use of r-lib/actions/pr-push

- uses: r-lib/actions/pr-push@master
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}

which doesn't have the correct access right because Github token passed is read-only on fork when trigger on pull request (which is different from comment).

More on GITHUB_TOKEN permission: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token

pr-push action was made for comment triggered action in the first place, and write access is there.

We need a two way process to render the README on PR from fork I guess.

Thanks for looking into this!

cderv commented

It needs to be triggered only when /render is present. Currently it works for any comments.
I need to fix this

cderv commented

Learnt the hard way that in GHA '' == false is true. So testing is false or missing is the same. Using contains() will handle that I believe.

cderv commented

And we'll only run the first step on PR

cderv commented

Just testing that this does not trigger a render of the README through issue_comment trigger