Cannot use fine-grained PATs to add labels to pull requests #9166

jamiesanson · 2024-06-04T09:42:34Z

Describe the bug

Using certain gh pr commands never works with a fine-grained PAT as GH_TOKEN, regardless of scopes granted to it.

CLI version:

gh version 2.50.0 (2024-05-29)
https://github.com/cli/cli/releases/tag/v2.50.0

Steps to reproduce the behavior

Create a fine-grained PAT with read-only access to every repository scope available, adding write access to the "pull request" scope.
Use the PAT generated in the previous step as the token used with gh (GH_TOKEN)
View an existing pull request: gh pr view 201
Observe the failure.

See: Fine-grained PAT permissions

Expected vs actual behavior

Expected: PR can be viewed successfully.

Actual: Error: GraphQL: Resource not accessible by personal access token (repository.pullRequest.projectCards.nodes)

The text was updated successfully, but these errors were encountered:

williammartin · 2024-06-04T09:45:30Z

Hey @jamiesanson, can you share the output of gh pr edit 201 --add-label Release with GH_DEBUG=api on? I suspect looking at the error that you need write permissions on something project related.

jamiesanson · 2024-06-04T09:54:06Z

Sure! Here's the output using GH_DEBUG=api

➜  test-repo git:(main) ✗ gh pr edit 210 --add-label Release
[git remote -v]
[git config --get-regexp ^remote\..*\.gh-resolved$]
* Request at 2024-06-04 10:49:36.506297 +0100 BST m=+0.055295334
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 419
> Content-Type: application/json; charset=utf-8
> Graphql-Features: merge_queue
> Time-Zone: Europe/London
> User-Agent: GitHub CLI 2.50.0

GraphQL query:
fragment repo on Repository {
    id
    name
    owner { login }
    viewerPermission
    defaultBranchRef {
      name
    }
    isPrivate
  }
  query RepositoryNetwork {
    viewer { login }

    repo_000: repository(owner: "██████████", name: "██████████") {
      ...repo
      parent {
        ...repo
      }
    }

  }
GraphQL variables: null

< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Tue, 04 Jun 2024 09:49:36 GMT
< Github-Authentication-Token-Expiration: 2024-06-11 10:49:09 +0100
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.v4; param=merge-info-preview.nebula-preview; format=json
< X-Github-Request-Id: D07C:1614D9:210EF8D:22A7647:665EE330
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4997
< X-Ratelimit-Reset: 1717498164
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 3
< X-Xss-Protection: 0

{
  "data": {
    "viewer": {
      "login": "jamiesanson"
    },
    "repo_000": {
      "id": "R_kgDOLAaeWw",
      "name": "██████████",
      "owner": {
        "login": "██████████"
      },
      "viewerPermission": "ADMIN",
      "defaultBranchRef": {
        "name": "main"
      },
      "isPrivate": true,
      "parent": null
    }
  }
}

* Request took 356.815333ms
⣾* Request at 2024-06-04 10:49:36.863555 +0100 BST m=+0.412551459
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 680
> Content-Type: application/json; charset=utf-8
> Graphql-Features: merge_queue
> Time-Zone: Europe/London
> User-Agent: GitHub CLI 2.50.0

GraphQL query:
query PullRequestByNumber($owner: String!, $repo: String!, $pr_number: Int!) {
    repository(owner: $owner, name: $repo) {
      pullRequest(number: $pr_number) {id,url,title,body,baseRefName,reviewRequests(first: 100) {nodes {requestedReviewer {__typename,...on User{login},...on Team{organization{login}name,slug}}}},assignees(first:100){nodes{id,login,name},totalCount},labels(first:100){nodes{id,name,description,color},totalCount},projectCards(first:100){nodes{project{name}column{name}},totalCount},milestone{number,title,description,dueOn},number}
    }
  }
GraphQL variables: {"owner":"██████████","pr_number":210,"repo":"██████████"}

⣻< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Tue, 04 Jun 2024 09:49:37 GMT
< Github-Authentication-Token-Expiration: 2024-06-11 10:49:09 +0100
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.v4; param=merge-info-preview.nebula-preview; format=json
< X-Github-Request-Id: D07C:1614D9:210EFC2:22A768F:665EE330
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4996
< X-Ratelimit-Reset: 1717498164
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 4
< X-Xss-Protection: 0

{
  "data": {
    "repository": {
      "pullRequest": {
        "id": "PR_kwDOLAaeW85wsfdO",
        "url": "https://github.com/██████████/██████████/pull/210",
        "title": "Update to 1.3.1",
        "body": "This PR updates the version to 1.3.1.\nSince the repo is using proactive versioning, 1.3.1 is the next version to be released.\nThe most recent release can be found at https://github.com/██████████/██████████/releases/tag/v1.3.0\n",
        "baseRefName": "main",
        "reviewRequests": {
          "nodes": []
        },
        "assignees": {
          "nodes": [],
          "totalCount": 1
        },
        "labels": {
          "nodes": [],
          "totalCount": 0
        },
        "projectCards": {
          "nodes": null,
          "totalCount": 0
        },
        "milestone": null,
        "number": 210
      }
    }
  },
  "errors": [
    {
      "type": "FORBIDDEN",
      "path": [
        "repository",
        "pullRequest",
        "projectCards",
        "nodes"
      ],
      "extensions": {
        "saml_failure": false
      },
      "locations": [
        {
          "line": 4,
          "column": 335
        }
      ],
      "message": "Resource not accessible by personal access token"
    }
  ]
}

* Request took 298.212167ms
GraphQL: Resource not accessible by personal access token (repository.pullRequest.projectCards.nodes)

jamiesanson · 2024-06-04T10:00:36Z

Note, I've also been able to reproduce the same issue with other gh pr commands - notably, gh pr view

williammartin · 2024-06-04T10:01:55Z

Yeh so we can see here that when we're looking for the PR using the PullRequestByNumber query, we're also trying to load projectCards and the API is saying the token doesn't have permission. I would expect the same for most pr commands because they all use the same mechanism for fetching a PR.

Can you try giving Project read access on the resource? I think it's probably under Organization rather than Repository in the settings page.

jamiesanson · 2024-06-04T10:05:36Z

I've given the fine-grained PAT write access to every scope available, and it still results in the same issue:

jamiesanson · 2024-06-04T10:08:48Z

Note: We've seen this working using a Classic Token with the Project read scope, so feels like an issue with fine-grained PATs and project access. The scopes we used were:

repo (for private repository access)
read:org (for users)
read:project (for project cards, presumably)

jamiesanson · 2024-06-04T10:13:16Z

Another note: We've also had this working with github.token in CI. These permissions yield a token which works:

permissions:
   # write: gh pr edit
   pull-requests: write
   # gh pr edit (workaround for this issue)
   repository-projects: read

williammartin · 2024-06-04T10:22:45Z

Hmmm looks like something similar was reported in March but wasn't triaged: #8784 and also on the community forums: https://github.com/orgs/community/discussions/111324

It may well be that fine-grained PATs don't support this. It wouldn't be the first time that things haven't been fully implemented. I'll see what I can find internally, thanks for your continued investigation.

williammartin · 2024-06-04T10:24:38Z

In the meantime I wonder whether we could be smarter about what we try to fetch. Like, is it really necessary for us to fetch projectCards in all cases?

Also loosely related: #6274

jamiesanson · 2024-06-04T10:43:52Z

In the meantime I wonder whether we could be smarter about what we try to fetch. Like, is it really necessary for us to fetch projectCards in all cases?

Yeah, we've had similar conversations internally. Based on what we've read in the code & documentation, --add-project and --remove-project are the only options which need it (aside from the view command, maybe), so could potentially only fetch projectCards in those cases.

jayspadie · 2024-06-04T21:04:02Z

Projects (classic) can be owned by the org or by the repository. Naively, when I see code like the above or in programmatic_access.yaml, it makes me wonder if we somehow missed adding project permissions to the Repository scope (repository_projects) in the Find-grained PAT UI, and we only offer the ability to create Organization scoped permissions (organization_projects).

https://github.com/github/github/blob/79f0df60f71c82e31b33361389b6e8819ee7b33d/config/access_control/programmatic_access.yaml#L9487-L9498

- namespace: Api::Projects
  endpoint: GET /projects/columns/:column_id/cards
  service: projects
  access_definition: show_project
  server_to_server:
    enabled: true
  user_to_server:
    enabled: true
  allows_public_read: true
  permission_sets:
  - repository_projects: read
  - organization_projects: read

ajvpot · 2024-06-11T19:43:29Z

In the meantime I wonder whether we could be smarter about what we try to fetch. Like, is it really necessary for us to fetch projectCards in all cases?

Yeah, we've had similar conversations internally. Based on what we've read in the code & documentation, --add-project and --remove-project are the only options which need it (aside from the view command, maybe), so could potentially only fetch projectCards in those cases.

This would definitely be helpful for us, we do not use projects and it would be ideal to not have to grant an extraneous permission.

dezren39 · 2024-07-18T21:33:14Z

also experiencing this with
gh pr checks --interval 30 --watch
or maybe
gh pr status --json statusCheckRollup --jq '[{ state: .currentBranch.statusCheckRollup[].state, conclusion: .currentBranch.statusCheckRollup[].conclusion }] | any(.state != null and .state != "SUCCESS") or any(.conclusion != null and .conclusion != "SUCCESS")'

jamiesanson added the bug Something isn't working label Jun 4, 2024

cliAutomation added the needs-triage needs to be reviewed label Jun 4, 2024

williammartin added the needs-user-input label Jun 4, 2024

williammartin added p2 Affects more than a few users but doesn't prevent core functions and removed needs-user-input needs-triage needs to be reviewed labels Jun 4, 2024

SureshPradhana mentioned this issue Jun 23, 2024

Added GitHub Action that adds context-v2 label to every issue, discussion and PR dcastil/tailwind-merge#434

Merged

itsyoboieltr mentioned this issue Aug 19, 2024

add-team-label workflow is missing implementation MetaMask/github-tools#24

Closed

omus mentioned this issue Sep 17, 2024

Experiment: Test label removing permissions beacon-biosignals/job-context#2

Closed

williammartin added the needs-triage needs to be reviewed label Oct 11, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cannot use fine-grained PATs to add labels to pull requests #9166

Cannot use fine-grained PATs to add labels to pull requests #9166

jamiesanson commented Jun 4, 2024 •

edited

Loading

williammartin commented Jun 4, 2024

jamiesanson commented Jun 4, 2024

jamiesanson commented Jun 4, 2024

williammartin commented Jun 4, 2024

jamiesanson commented Jun 4, 2024

jamiesanson commented Jun 4, 2024 •

edited

Loading

jamiesanson commented Jun 4, 2024 •

edited

Loading

williammartin commented Jun 4, 2024

williammartin commented Jun 4, 2024 •

edited

Loading

jamiesanson commented Jun 4, 2024

jayspadie commented Jun 4, 2024

ajvpot commented Jun 11, 2024

dezren39 commented Jul 18, 2024

Cannot use fine-grained PATs to add labels to pull requests #9166

Cannot use fine-grained PATs to add labels to pull requests #9166

Comments

jamiesanson commented Jun 4, 2024 • edited Loading

Describe the bug

Steps to reproduce the behavior

Expected vs actual behavior

williammartin commented Jun 4, 2024

jamiesanson commented Jun 4, 2024

jamiesanson commented Jun 4, 2024

williammartin commented Jun 4, 2024

jamiesanson commented Jun 4, 2024

jamiesanson commented Jun 4, 2024 • edited Loading

jamiesanson commented Jun 4, 2024 • edited Loading

williammartin commented Jun 4, 2024

williammartin commented Jun 4, 2024 • edited Loading

jamiesanson commented Jun 4, 2024

jayspadie commented Jun 4, 2024

ajvpot commented Jun 11, 2024

dezren39 commented Jul 18, 2024

jamiesanson commented Jun 4, 2024 •

edited

Loading

jamiesanson commented Jun 4, 2024 •

edited

Loading

jamiesanson commented Jun 4, 2024 •

edited

Loading

williammartin commented Jun 4, 2024 •

edited

Loading