[BUG] flowwer-dev/pull-request-stats: Resource not accessible by integration

[macohen]

What is the bug?
I have an issue where I’m trying to integrate a github action (https://github.com/flowwer-dev/pull-request-stats) that should add a comment with PR stats to every PR. I’ve been trying to make it work with PRs opened against main, but it was failing due to permissions (https://github.com/opensearch-project/search-processor/actions/runs/3766987233/jobs/6404075146). I also created two branches in the repo and made a PR from one to the other. That one succeeded: (#62). It’s strange to me that a PR to main would have different permissions than a PR to a different branch and I'm not sure where to go from there.

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Enable the (Pull Request Stats)[https://github.com/opensearch-project/search-processor/actions/workflows/pr_stats.yml]
2. Create a PR to merge to main
3. Watch the check fail like in: https://github.com/opensearch-project/search-processor/actions/runs/3766987233

What is the expected behavior?
A comment should be added to the PR like #62 (comment)

What is your host/environment?
N/A

Do you have any screenshots?
No, but the logfile with error is here: logs_561.zip

Do you have any additional context?
Add any other context about the problem.

[macohen]

@manuelmhtr unfortunately that didn't seem to do the trick. is there a different setting? thanks for the quick response on this!

[manuelmhtr]

@macohen ohh I see...

I checked the last run and it seems the pull request permission still read. I think there's an organization or repository setting that prevents the action from getting the read permission. Let me check which setting could be 🤔

[manuelmhtr]

I found the problem 💡

All failing jobs come from a fork. By default, Github limits the action's permissions to read when they come from a fork.

To make it work you should go to the Organization Settings -> Actions -> General, and check the options "Run workflows from fork pull requests" and "Send write tokens to workflows from fork pull requests." (I'd suggest "Require approval for fork pull request workflows." too for increasing security).

I hope it helps!

[macohen]

@manuelmhtr Do you think it would be possible to create an alternative solution to work around this? I'm thinking about a scheduled action that creates a new issue in the repo with the table. It would be great to see this on a weekly basis. Maybe also aggregated monthly.

[noCharger]

PR stats works in 2.x branch #76 (comment)

[macohen]

yep. it doesn't seem to work for pull requests coming from forked repositories because that would mean giving certain write permissions to anyone who forks the repo and issues a PR. if you branch within the repo it works. I still like the idea of a report in an issue that can be viewed separately.

[msfroh]

We could run only on backport PRs?

We can also come up with another way of tracking / recording PR stats.

Closing this one in favor of finding another solution.