[Docs]: How to use a fine-grained PAT? #557

JakobHavtorn · 2024-08-13T06:24:12Z

Describe the documentation issue

In the section on using a PAT to authorise the Action (https://github.com/AndreasAugustin/actions-template-sync?tab=readme-ov-file#3-using-a-pat) there is an example of using a "classic" token, but not one for the new "fine-grained" token type.

We are struggling to create a fine-grained token to give the Action the permissions it needs. We have tried with the below permissions, but get following error during the action-template-sync step of the Action:

git init
  ::info::set git global configuration
  ::info::the source repository is located within GitHub.
  github.com
    ✓ Logged in to github.com account MyAccount (GITHUB_TOKEN)
    - Active account: true
    - Git operations protocol: https
    - Token: github_pat_************************_***********************************************************
remote: Repository not found.
fatal: repository 'https://github.com/corticph/my-template-repository/' not found
fatal: Needed a single revision
Error: Process completed with exit code 128.

We have previously had the action running with a classic token with the following permissions:

Links

https://github.com/AndreasAugustin/actions-template-sync?tab=readme-ov-file#3-using-a-pat

Acknowledgements

I may be able to submit a pull-request to fix this issue.

The text was updated successfully, but these errors were encountered:

AndreasAugustin · 2024-08-15T08:55:40Z

Hi @JakobHavtorn and thanks for the issue.

Does the token have access to the remote repository? The token has also a setting related to repository access.

JakobHavtorn · 2024-08-15T13:39:36Z

Hi @AndreasAugustin, yes it has access (only) to the two (remote) template repositories that we want to sync towards, via the "Only select repositories" option. And this includes the my-template-repository in the error message above.

davidsnyder · 2024-09-04T18:13:53Z

Encountered the same issue with PATs:

git init
  ::info::set git global configuration
  ::info::the source repository is located within GitHub.
  github.com
    ✓ Logged in to github.com account <github-account> (GITHUB_TOKEN)
    - Active account: true
    - Git operations protocol: https
    - Token: ghp_************************************
    - Token scopes: 'read:org', 'repo'
remote: Repository not found.
fatal: repository 'https://github.com/<org>/<template-repo>/' not found
fatal: Needed a single revision
Error: Process completed with exit code 128.

I set the token permissions for read:org and repo as described in the README as well as enabling access from other repositories in the source 's settings.

AndreasAugustin · 2024-09-04T18:34:44Z

Encountered the same issue with PATs:

git init
  ::info::set git global configuration
  ::info::the source repository is located within GitHub.
  github.com
    ✓ Logged in to github.com account <github-account> (GITHUB_TOKEN)
    - Active account: true
    - Git operations protocol: https
    - Token: ghp_************************************
    - Token scopes: 'read:org', 'repo'
remote: Repository not found.
fatal: repository 'https://github.com/<org>/<template-repo>/' not found
fatal: Needed a single revision
Error: Process completed with exit code 128.

I set the token permissions for read:org and repo as described in the README as well as enabling access from other repositories in the source 's settings.

Hi @davidsnyder and thanks for the heads up.
Hmm that is somehow weird. Is possibly the source repo private and the target repo public?
Trying to find some time.

@JakobHavtorn super sorry for not getting to work on this issue. Needed to prio some of my actual work tasks

davidsnyder · 2024-09-04T18:38:23Z

Encountered the same issue with PATs:
git init
  ::info::set git global configuration
  ::info::the source repository is located within GitHub.
  github.com
    ✓ Logged in to github.com account <github-account> (GITHUB_TOKEN)
    - Active account: true
    - Git operations protocol: https
    - Token: ghp_************************************
    - Token scopes: 'read:org', 'repo'
remote: Repository not found.
fatal: repository 'https://github.com/<org>/<template-repo>/' not found
fatal: Needed a single revision
Error: Process completed with exit code 128.
I set the token permissions for read:org and repo as described in the README as well as enabling access from other repositories in the source 's settings.
Hi @davidsnyder and thanks for the heads up. Hmm that is somehow weird. Is possibly the source repo private and the target repo public? Trying to find some time.

@JakobHavtorn super sorry for not getting to work on this issue. Needed to prio some of my actual work tasks

Both are private

AndreasAugustin · 2024-09-04T19:07:14Z

Encountered the same issue with PATs:
git init
  ::info::set git global configuration
  ::info::the source repository is located within GitHub.
  github.com
    ✓ Logged in to github.com account <github-account> (GITHUB_TOKEN)
    - Active account: true
    - Git operations protocol: https
    - Token: ghp_************************************
    - Token scopes: 'read:org', 'repo'
remote: Repository not found.
fatal: repository 'https://github.com/<org>/<template-repo>/' not found
fatal: Needed a single revision
Error: Process completed with exit code 128.
I set the token permissions for read:org and repo as described in the README as well as enabling access from other repositories in the source 's settings.
Hi @davidsnyder and thanks for the heads up. Hmm that is somehow weird. Is possibly the source repo private and the target repo public? Trying to find some time.
@JakobHavtorn super sorry for not getting to work on this issue. Needed to prio some of my actual work tasks
Both are private

thanks for the answer. Just made a test -> I am able to use a classic PAT without issues.
2 possible issues

typo within path or PAT (or possible whitespaces within secret or definition file)?
the PAT does not have access to the repo?

Update
Not sure but I guess you edited the error message? (sorry for asking this).
fatal: repository 'https://github.com/<org>/<template-repo>/' not found
I guess you replaced the real org and template-repo here?

AndreasAugustin · 2024-09-04T19:28:03Z

@JakobHavtorn just tested a fine grained PAT with the following settings: it is working

(please be aware that I gave permissions to both source and target repo)

repo permissions:

contents -> write
metadata -> read
pull requests -> write

also settings set like for classic PAT within source repo (currently not sure if needed).

Would be nice if you could test this.
You checked that you possibly want to update the DOCs? Would be nice if possible :) (if not I can do that)

JakobHavtorn · 2024-09-04T19:30:50Z

Thanks @AndreasAugustin! I'll check it tomorrow. I'll try to make a PR with an update to the docs this week 🙌

davidsnyder · 2024-09-18T16:19:04Z

For some reason I still can't get this to work. I made several changes related to the fine grained PAT permissions because I thought that was the problem (for example, if you're trying to clone a template repo owned by an org, I believe the org needs to be the owner of the PAT, not your personal account)

Once I have the PAT, if I open a private terminal session and run:

sh-3.2# export GITHUB_TOKEN=<github_PAT>
sh-3.2# gh auth status --hostname github.com
github.com
  ✓ Logged in to github.com account davidsnyder (GITHUB_TOKEN)
  - Active account: true
  - Git operations protocol: https
  - Token: github_pat_11AABX55A0cE5DX5rKyFpu_***********************************************************
sh-3.2# git ls-remote https://github.com/<org>/plugin-template-go HEAD
f8be11f1751dd27599435d160777e2b3ba13a528	HEAD

git ls-remote works as expected.

But when I run the plugin as a Github Action it prints

github.com
  ✓ Logged in to github.com account davidsnyder (GITHUB_TOKEN)
  - Active account: true
  - Git operations protocol: https
  - Token: github_pat_11AABX55A0cE5DX5rKyFpu_***********************************************************

which shows that it logged in successfully via GITHUB_TOKEN
but then it later prints

+++ git ls-remote https://github.com/<org>/plugin-template-go HEAD
remote: Repository not found.
fatal: repository 'https://github.com/<org>/plugin-template-go/' not found
++ TEMPLATE_REMOTE_GIT_HASH=
+++ git rev-parse --short ''
fatal: Needed a single revision

which is the same error as before (I enabled -x so it would print the command) as if it doesn't have access to view the private repo. Seeing as it's the same GITHUB_TOKEN, and the login procedure is the same, I don't understand how the behavior could be different.

My workflow file is

name: Sync from Template

on:
  workflow_dispatch: # manual trigger

jobs:
  repo-sync:
    runs-on: ubuntu-latest

    steps:
    -
      name: Checkout
      uses: actions/checkout@v4
    -
      name: actions-template-sync
      uses: AndreasAugustin/actions-template-sync@v2.2.3
      with:
        github_token: ${{ secrets.PLUGIN_TEMPLATE_SYNC }}
        source_repo_path: <org>/plugin-template-go
        upstream_branch: main

davidsnyder · 2024-09-18T17:25:21Z

Finally figured it out after looking here: https://github.com/orgs/community/discussions/25240

Had to add persist-credentials: false to the checkout action. My final workflow file is as follows:

name: Sync from Template

on:
  workflow_dispatch: # manual trigger

jobs:
  repo-sync:
    runs-on: ubuntu-latest

    steps:
    -
      name: Checkout
      uses: actions/checkout@v4
      with:
        persist-credentials: false
    -
      name: actions-template-sync
      uses: davidsnyder/actions-template-sync@main
      with:
        github_token: ${{ secrets.PLUGIN_TEMPLATE_SYNC_ACTION }}
        source_repo_path: <org>/plugin-template-go
        upstream_branch: main

When you update the docs, maybe add a note about this!

AndreasAugustin · 2024-09-18T17:38:04Z

Finally figured it out after looking here: https://github.com/orgs/community/discussions/25240

Had to add persist-credentials: false to the checkout action. My final workflow file is as follows:
name: Sync from Template

on:
  workflow_dispatch: # manual trigger

jobs:
  repo-sync:
    runs-on: ubuntu-latest

    steps:
    -
      name: Checkout
      uses: actions/checkout@v4
      with:
        persist-credentials: false
    -
      name: actions-template-sync
      uses: davidsnyder/actions-template-sync@main
      with:
        github_token: ${{ secrets.PLUGIN_TEMPLATE_SYNC_ACTION }}
        source_repo_path: <org>/plugin-template-go
        upstream_branch: main
When you update the docs, maybe add a note about this!

Hi @davidsnyder ,
nice that you found a solution.

Remark:
Actually I do not fully understand the root cause yet. Also why it is working in other scenarios without using the flag.

davidsnyder · 2024-09-18T18:45:53Z

Unfortunately, I'm not sure either! But I tried everything I could think of and it started working only after I added persist-credentials: false.

AndreasAugustin added the documentation Improvements or additions to documentation label Aug 15, 2024

AndreasAugustin self-assigned this Sep 4, 2024

AndreasAugustin assigned AndreasAugustin and JakobHavtorn and unassigned AndreasAugustin Sep 4, 2024

This comment was marked as off-topic.

Sign in to view

allcontributors bot mentioned this issue Sep 18, 2024

docs: add davidsnyder as a contributor for research #564

Merged

This comment was marked as off-topic.

Sign in to view

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Docs]: How to use a fine-grained PAT? #557

[Docs]: How to use a fine-grained PAT? #557

JakobHavtorn commented Aug 13, 2024 •

edited

Loading

AndreasAugustin commented Aug 15, 2024

JakobHavtorn commented Aug 15, 2024

davidsnyder commented Sep 4, 2024

AndreasAugustin commented Sep 4, 2024

davidsnyder commented Sep 4, 2024

AndreasAugustin commented Sep 4, 2024 •

edited

Loading

AndreasAugustin commented Sep 4, 2024 •

edited

Loading

JakobHavtorn commented Sep 4, 2024

davidsnyder commented Sep 18, 2024 •

edited

Loading

davidsnyder commented Sep 18, 2024 •

edited

Loading

AndreasAugustin commented Sep 18, 2024

This comment was marked as off-topic.

This comment was marked as off-topic.

davidsnyder commented Sep 18, 2024

[Docs]: How to use a fine-grained PAT? #557

[Docs]: How to use a fine-grained PAT? #557

Comments

JakobHavtorn commented Aug 13, 2024 • edited Loading

Describe the documentation issue

Links

Acknowledgements

AndreasAugustin commented Aug 15, 2024

JakobHavtorn commented Aug 15, 2024

davidsnyder commented Sep 4, 2024

AndreasAugustin commented Sep 4, 2024

davidsnyder commented Sep 4, 2024

AndreasAugustin commented Sep 4, 2024 • edited Loading

AndreasAugustin commented Sep 4, 2024 • edited Loading

JakobHavtorn commented Sep 4, 2024

davidsnyder commented Sep 18, 2024 • edited Loading

davidsnyder commented Sep 18, 2024 • edited Loading

AndreasAugustin commented Sep 18, 2024

This comment was marked as off-topic.

This comment was marked as off-topic.

davidsnyder commented Sep 18, 2024

JakobHavtorn commented Aug 13, 2024 •

edited

Loading

AndreasAugustin commented Sep 4, 2024 •

edited

Loading

AndreasAugustin commented Sep 4, 2024 •

edited

Loading

davidsnyder commented Sep 18, 2024 •

edited

Loading

davidsnyder commented Sep 18, 2024 •

edited

Loading