push-to-fork fails with Resource not accessible by personal access token

[oscarbenjamin]

Subject of the issue

I am trying to follow the instructions for push-to-fork with a machine user from here:
https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#push-pull-request-branches-to-a-fork

It currently succeeds in pushing to the machine account's fork but fails to create the pull request back to my repo with:

Create or update the pull request
  Attempting creation of pull request
  Error: Resource not accessible by personal access token

https://github.com/oscarbenjamin/protosym/actions/runs/4583286227/jobs/8094040007

The workflow is in a repo under my account but has been given a fine grained PAT to access the machine account:
https://github.com/oscarbenjamin/protosym/blob/147544959f655f2fc1c5a599e6464d962cff3624/.github/workflows/updater.yml#L22-L23

I'm unsure what this error means as in whether it means that the particular PAT does not have enough permissions or if it is that the action is not something that can be done by any PAT.

The permissions given to the fine grained PAT from the machine account are limited to the machine account's fork ("only select repositories") and are given as:

• Contents read/write
• metadata read
• workflows read/write
• pull requests read/write

In my repo in the actions settings I have ticked the box that says "Allow GitHub Actions to create and approve pull requests". I also tried selecting the "Read and write access" under "workflow permissions".

Is there something else that I am missing here?

[oscarbenjamin]

I switched to using a classic PAT from the machine account with "repo" and "workflow" scope and then it worked.

[oscarbenjamin]

I have tried using a fine grained PAT again and giving it every possible permission to the machine account and all of its repos but it still fails to open the pull request.

Maybe it is just not possible to get this setup working with a fine grained PAT.

[peter-evans]

Hi @oscarbenjamin

Maybe it is just not possible to get this setup working with a fine grained PAT.

That would not surprise me. Fine-grained access tokens are still in beta and I know that GitHub's GraphQL API is not supported yet. This action uses the REST API, which supposedly is supported, but perhaps some edge cases are not covered yet.

Error: Resource not accessible by personal access token

I've not seen this error message before, and it seems likely that the meaning is that the new fine-grained access tokens aren't supported for that particular case.

[boegel]

For what it's worth: I just ran into the same problem when trying to use a fine-grained PAT:

Create or update the pull request
  Attempting creation of pull request
  Error: Resource not accessible by personal access token

I wanted to use a fine-grained PAT so I can constrain the token to a specific repository (the fork in which branches should be created), and I gave the permissions that made sense: read-write for Contents and Pull requests (and Metadata read-only, but that's an implied one).

That didn't work, so I had to resort to a classic token with repo and workflow permissions

[peter-evans]

@oscarbenjamin @boegel

For the upcoming v7 release I've been doing lots of testing and I think I understand why this wasn't working for you both. I've managed to get fine-grained PATs working with push-to-fork, but there are limitations, which may make it not viable for your particular cases.

Please read the new documentation for the v7 release at the following link. If it's not clear and you don't understand how it applies to your case, please let me know.
https://github.com/peter-evans/create-pull-request/blob/signed-commits/docs/concepts-guidelines.md#pushing-to-a-fork-with-fine-grained-permissions

You can try the release candidate for v7 like this:

- uses: peter-evans/create-pull-request@v7-rc

[oscarbenjamin]

Thanks @peter-evans for working on this!

I would like to test this out and give feedback but:

I have moved on now from my original problem that motivated this. I am even a little confused reading my comments above and trying to remember what I was doing when I opened the issue...

Unfortunately that means that I do not have an easy way to test this any more.

[boegel]

@peter-evans Thanks a lot for the extra info, the documentation makes sense to me, except for one part:

"The parent and fork both have the same owner."

This should be clarified, I think. What's owner here? If parent is peter-evans/create-pull-request and fork is boegel/create-pull-request, doesn't that imply different owners?

I haven't tried it yet, but I'll try to get back to this the next time I need to refresh the classic token, I'll try to use a fine-grained PAT then using v7-rc (or another more recent tag/commit).

[peter-evans]

@boegel Thanks for reviewing the documentation.

The parent and fork both have the same owner

This basically means the parent and fork are in the same org. I will clarify that in the docs.