[ci] no-response bot is broken

[jameslamb]

Description

See, for example, #6311.

The original poster responded, but the awaiting response label wasn't automatically removed.

Failing build: https://github.com/microsoft/LightGBM/actions/runs/7901178460/job/21564224042

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/lee-dohm/no-response/v0.5.0/dist/index.js:3430:23
    at processTicksAndRejections (node:internal/process/task_queues:96:5) {
  status: 403,

full log (click me)

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/lee-dohm/no-response/v0.5.0/dist/index.js:3430:23
    at processTicksAndRejections (node:internal/process/task_queues:96:5) {
  status: 403,
  headers: {
    'access-control-allow-origin': '*',
    'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
    connection: 'close',
    'content-encoding': 'gzip',
    'content-security-policy': "default-src 'none'",
    'content-type': 'application/json; charset=utf-8',
    date: 'Wed, 14 Feb 2024 12:28:16 GMT',
    'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
    server: 'GitHub.com',
    'strict-transport-security': 'max-age=3[15](https://github.com/microsoft/LightGBM/actions/runs/7901178460/job/21564224042#step:2:16)36000; includeSubdomains; preload',
    'transfer-encoding': 'chunked',
    vary: 'Accept-Encoding, Accept, X-Requested-With',
    'x-accepted-github-permissions': 'issues=write; pull_requests=write',
    'x-content-type-options': 'nosniff',
    'x-frame-options': 'deny',
    'x-github-api-version-selected': '2022-11-28',
    'x-github-media-type': 'github.v3; format=json',
    'x-github-request-id': 'E483:41E6:2E9329C:5D717B8:65CCB1E0',
    'x-ratelimit-limit': '15000',
    'x-ratelimit-remaining': '14997',
    'x-ratelimit-reset': '1707917296',
    'x-ratelimit-resource': 'core',
    'x-ratelimit-used': '3',
    'x-xss-protection': '0'
  },
  request: {
    method: 'DELETE',
    url: 'https://api.github.com/repos/microsoft/LightGBM/issues/6311/labels/awaiting%20response',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'octokit-core.js/3.2.4 Node.js/[16](https://github.com/microsoft/LightGBM/actions/runs/7901178460/job/21564224042#step:2:17).[20](https://github.com/microsoft/LightGBM/actions/runs/7901178460/job/21564224042#step:2:21).2 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-length': 0
    },
    request: {
      agent: Agent {
        _events: [Object: null prototype] {
          free: [Function (anonymous)],
          newListener: [Function: maybeEnableKeylog]
        },
        _eventsCount: 2,
        _maxListeners: undefined,
        defaultPort: 443,
        protocol: 'https:',
        options: [Object: null prototype] { path: null },
        requests: [Object: null prototype] {},
        sockets: [Object: null prototype] {},
        freeSockets: [Object: null prototype] {},
        keepAliveMsecs: 1000,
        keepAlive: false,
        maxSockets: Infinity,
        maxFreeSockets: [25](https://github.com/microsoft/LightGBM/actions/runs/7901178460/job/21564224042#step:2:26)6,
        scheduling: 'lifo',
        maxTotalSockets: Infinity,
        totalSocketCount: 0,
        maxCachedSessions: 100,
        _sessionCache: {
          map: {
            'api.github.com:4[43](https://github.com/microsoft/LightGBM/actions/runs/7901178460/job/21564224042#step:2:44):::::::::::::::::::::': [Buffer [Uint8Array]]
          },
          list: [ 'api.github.com:[44](https://github.com/microsoft/LightGBM/actions/runs/7901178460/job/21564224042#step:2:45)3:::::::::::::::::::::' ]
        },
        [Symbol(kCapture)]: false
      },
      hook: [Function: bound bound register]
    }
  },
  documentation_url: 'https://docs.github.com/rest/issues/labels#remove-a-label-from-an-issue'
}

Reproducible example

Any recent No Response Bot runs trying to modify things in this repo: https://github.com/microsoft/LightGBM/actions/workflows/no-response.yml.

Additional Comments

It's been 3 years since that project last received a commit: https://github.com/lee-dohm/no-response

I believe it might just no longer work with GitHub's API.

Noticed that over in shap, they are using https://github.com/actions/stale: shap/shap#3424.

That's a GitHub-official action, so we should probably move to that.

[jmoralez]

FWIW the closing of issues seems to be working still (comment, logs).

[jameslamb]

Oh interesting!

Since those are both from mlforecast.... maybe it's not that the app is broken? Maybe this is a permissions issue.

We don't have a dedicated token for that bot:

LightGBM/.github/workflows/no-response.yml

Line 23 in 6330d62

token: ${{ github.token }}

The docs at https://github.com/lee-dohm/no-response?tab=readme-ov-file#inputs say

The default GitHub Actions token is sufficient.

And I see mlforecast is just using the default one: https://github.com/Nixtla/mlforecast/blob/main/.github/workflows/no-response.yaml#L21.

I strongly suspect that someone at Microsoft changed the default permissions for the default tokens... either for this repo specifically or organization-wide. From https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/#setting-the-default-permissions-for-the-organization-or-repository

A new admin setting lets you set the default permissions for the token in your organization or repository.

You can choose between two options:

• Read/write for all scopes (current default)
• Read repo contents

Setting the default to contents:read is sufficient for any workflows that simply need to clone and build. If you need additional permissions you will need to specify those in your workflow yaml.

I can try adding extra permissions to that workflow, as that blogpost suggests.

[jmoralez]

Just saw it remove the label as well in this issue (logs)

[jmoralez]

I strongly suspect that someone at Microsoft changed the default permissions for the default tokens

I agree. The error here is a 403 and this stackoverflow answer suggests that as well

[jameslamb]

I just merged #6323, then triggered this run of the no-response bot: https://github.com/microsoft/LightGBM/actions/runs/7964739283

It didn't like being run with workflow_dispatch 😭

Unrecognized event: workflow_dispatch

https://github.com/lee-dohm/no-response/blob/66174372c9c5576aa8a4287e33653f2fdd12d517/src/main.ts#L17-L19

Guess we'll have to wait until the next scheduled run about 8 hours from now.

[jameslamb]

It looks like the changes from #6323 partially worked.

I just saw the bot closed some issues and post comments:

• How to make lightgbm into a static or dynamic library used on Android and IOS apps. #6200 (comment)
• Hyperparameter tuning for an LGBM classifier #6275 (comment)
• [python-package] Can't import LightGBM into Jupyter notebook on M1 MacOS #6262 (comment)

But it failed to remove labels 🤔

I don't see any errors in the logs: https://github.com/microsoft/LightGBM/actions/runs/7968288344/job/21752319533

Or any meaningful difference between LightGBM's configuration

LightGBM/.github/workflows/no-response.yml

Lines 14 to 27 in 45a60a7

	jobs:
	noResponse:
	runs-on: ubuntu-22.04
	steps:
	- uses: lee-dohm/no-response@v0.5.0
	with:
	closeComment: >
	This issue has been automatically closed because it has been awaiting a response for too long.
	When you have time to to work with the maintainers to resolve this issue, please post a new comment and it will be re-opened.
	If the issue has been locked for editing by the time you return to it, please open a new issue and reference this one.
	Thank you for taking the time to improve LightGBM!
	daysUntilClose: 30
	responseRequiredLabel: awaiting response
	token: ${{ github.token }}

And mlforecast's

https://github.com/Nixtla/mlforecast/blob/02a2a85496416f2d86ebc7694535929da39b3e2f/.github/workflows/no-response.yaml#L9-L21

Maybe it's a permissions issue, but I don't understand what. These examples suggest that issues: write (which we're already giving this workflow) should be sufficient to modify issue and pull request labels:

• https://docs.github.com/en/actions/managing-issues-and-pull-requests/adding-labels-to-issues
• https://docs.github.com/en/actions/managing-issues-and-pull-requests/removing-a-label-when-a-card-is-added-to-a-project-board-column

Maybe that's actually not ever worked in LightGBM?

I see 85 closed issues that still have the awaiting response label on them: https://github.com/microsoft/LightGBM/issues?q=is%3Aissue+label%3A%22awaiting+response%22+is%3Aclosed

And examples like #6029 where it seems that it's actually been lock-bot, not no-response bot, that removes that label:

@jmoralez do you see any differences between LightGBM's and mlforecast's configuration that might explain why no-response isn't dropping the awaiting response label?

[jameslamb]

ohhhh wait I see it! I think that example from Nixtla/mlforecast#312 shows the bot closing it because the original author commented.

From https://github.com/lee-dohm/no-response?tab=readme-ov-file#issue_comment-event

issue_comment Event
When an issue_comment event is received, if all of the following are true:

- The author of the comment is the original author of the issue
- The issue has a label named the same as the responseRequiredLabel value in the configuration

It will:

- Remove the responseRequiredLabel
- Reopen the issue if it was closed by someone other than the original author of the issue

So I think this is all working as it's expected to. lock-bot should end up removing that awaiting response label when it eventually locks the issues.

I'm gonna close this. Thanks so much for the help!

[github-actions]

This issue has been automatically locked since there has not been any recent activity since it was closed.
To start a new related discussion, open a new issue at https://github.com/microsoft/LightGBM/issues including a reference to this.