Fail gracefully if GITHUB_TOKEN is set with non-working permissions #1272

Activity

1. MikeMcC399

   added

   type: enhancementNew feature or requestNew feature or request

   Cypress Cloud

   on Oct 3, 2024
2. MikeMcC399 commented on Oct 21, 2024

   

   MikeMcC399

   on Oct 21, 2024

   CollaboratorAuthor

   More actions

   This is a topic for the Cypress Cloud team.
3. VolodymyrSmahliuk commented on Jan 16, 2025

   

   VolodymyrSmahliuk

   on Jan 16, 2025

   Last edited by VolodymyrSmahliuk

   More actions

   I'm not sure where to publish my findings, but this issue seems to be related.

   When working with Cypress Test in Parallel mode, we faced the permissions issue. I'm going to list the error and appropriate permissions to fix

   (FYI, we have the next GitHub Repository Workflow permissions)

   

   ---

   The basic GitHub Actions permissions were:

   permissions:
     id-token: write # This is required for requesting the JWT (OIDC with AWS)
     contents: read # This is required for actions/checkout

   We get the Resource not accessible by integration ERROR with additional context:

   Unable to fetch related PR data for commit: 'xxx':  RequestError [HttpError]: Resource not accessible by integration
       at /home/runner/work/_actions/cypress-io/github-action/v6/dist/index.js:41021:21
       at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
       at async detectPrNumber (/home/runner/work/_actions/cypress-io/github-action/v6/dist/index.js:98218:22)
       at async runTests (/home/runner/work/_actions/cypress-io/github-action/v6/dist/index.js:98489:3) {
     status: 403,

   headers: {
         vary: 'Accept-Encoding, Accept, X-Requested-With',
         'x-accepted-github-permissions': 'pull_requests=read',
         'x-content-type-options': 'nosniff',
         'x-frame-options': 'deny',
   }

   According to the GitHub headers (which are extremely informative) the fix was adding the pull-requests: read permission:

   permissions:
     id-token: write # This is required for requesting the JWT (OIDC with AWS)
     contents: read # This is required for actions/checkout
     pull-requests: read # This is required for Cypress run

   After that, the same ERROR, but no context in the logs anymore

   

   After some investigation by updating the permissions, I found the required one (actions: write):

   permissions:
     id-token: write # This is required for requesting the JWT (OIDC with AWS)
     contents: read # This is required for actions/checkout
     pull-requests: read # This is required for Cypress run
     actions: write # This is required for Cypress run

   Now I have the job result

   

   I hope it will help to anyone 🎉

   PS: let's like the #1273 Issue to provide documentation update!

   👍React with 👍3Reacted by Anna, Volodymyr Starodubov and Ivan Kolodrivskyi
4. MikeMcC399 commented on Jan 16, 2025

   

   MikeMcC399

   on Jan 16, 2025

   CollaboratorAuthor

   More actions

   @VolodymyrSmahliuk

   I'm not sure where to publish my findings, but this issue seems to be related.

   • Thank you for your detailed description. Would you like to move (or copy) your post to Document GITHUB_TOKEN settings - Cypress Cloud recording #1273?

   👍React with 👍1Reacted by Volodymyr Smahliuk