Docs-website: Github action for routing issues and PRs to boards is throwing an error

[jpvajda]

see PR #1149 for failed check, but it seems a github token may be required for this check to run.

On the content job:

Run srggrs/[email protected]
/usr/bin/docker run --name srggrsassignoneprojectgithubaction120_ef2deb --label 5588e4 --workdir /github/workspace --rm -e INPUT_PROJECT -e INPUT_COLUMN_NAME -e HOME -e GITHUB_JOB -e GITHUB_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_REPOSITORY_OWNER -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RETENTION_DAYS -e GITHUB_ACTOR -e GITHUB_WORKFLOW -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GITHUB_EVENT_NAME -e GITHUB_SERVER_URL -e GITHUB_API_URL -e GITHUB_GRAPHQL_URL -e GITHUB_WORKSPACE -e GITHUB_ACTION -e GITHUB_EVENT_PATH -e GITHUB_ACTION_REPOSITORY -e GITHUB_ACTION_REF -e GITHUB_PATH -e GITHUB_ENV -e RUNNER_OS -e RUNNER_TOOL_CACHE -e RUNNER_TEMP -e RUNNER_WORKSPACE -e ACTIONS_RUNTIME_URL -e ACTIONS_RUNTIME_TOKEN -e ACTIONS_CACHE_URL -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/_temp/_runner_file_commands":"/github/file_commands" -v "/home/runner/work/docs-website/docs-website":"/github/workspace" srggrs/assign-one-project-github-action:1.2.0  "https://github.com/newrelic/docs-website/projects/3" "Needs Triage"
GITHUB_TOKEN not defined

Though the localization check passed, assuming because there was no localization label.

[jpvajda]

It looks like it made it to the right board, but maybe that was done manually? @austin-schaefer ?

[jpvajda]

it looks like the actions do need a GH token to move issues to other boards.

Run srggrs/[email protected]
/usr/bin/docker run --name srggrsassignoneprojectgithubaction120_bc5df4 --label 5588e4 --workdir /github/workspace --rm -e INPUT_PROJECT -e INPUT_COLUMN_NAME -e HOME -e GITHUB_JOB -e GITHUB_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_REPOSITORY_OWNER -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RETENTION_DAYS -e GITHUB_ACTOR -e GITHUB_WORKFLOW -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GITHUB_EVENT_NAME -e GITHUB_SERVER_URL -e GITHUB_API_URL -e GITHUB_GRAPHQL_URL -e GITHUB_WORKSPACE -e GITHUB_ACTION -e GITHUB_EVENT_PATH -e GITHUB_ACTION_REPOSITORY -e GITHUB_ACTION_REF -e GITHUB_PATH -e GITHUB_ENV -e RUNNER_OS -e RUNNER_TOOL_CACHE -e RUNNER_TEMP -e RUNNER_WORKSPACE -e ACTIONS_RUNTIME_URL -e ACTIONS_RUNTIME_TOKEN -e ACTIONS_CACHE_URL -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/_temp/_runner_file_commands":"/github/file_commands" -v "/home/runner/work/docs-website/docs-website":"/github/workspace" srggrs/assign-one-project-github-action:1.2.0  "https://github.com/newrelic/docs-website/projects/3" "Needs Triage"
GITHUB_TOKEN not defined

[jpvajda]

1153 > Failed test on both checks with both the localization and content labels present.

[austin-schaefer]

Yep did #1149 manually @jpvajda . #1155 failed for me a few minutes ago as well.

[bradleycamacho]

Interestingly, some PRs like #1151 are passing the check, but it doesn't seem like it got moved onto the board.

[jpvajda]

Should be fixed in #1163 @austin-schaefer @bradleycamacho

[jpvajda]

opting to re-open this as there are some new issues with the TOKEN we are using.

[jpvajda]

It seems we having problems using the opensource tokens on forked repo PRS, @LizBaker was looking into this the last I heard.

[LizBaker]

here's my understanding so far:
we need to use a token so that the workflow can act on behalf of the repo/project, we have a universal token under the OPENSOURCE_BOT_TOKEN secret with all the permissions we need and were using this. unfortunately (but fortunately for security purposes) a forked repo cannot access the original repos secrets, so we lose the value of OPENSOURCE_BOT_TOKEN and get an undefined error for PRs coming from a fork. the built in GITHUB_TOKEN can be accessed by forked repos (and is the only secret with this permission) but is read only, which still won't solve our problem because our workflow needs write access.

we could whip up something like https://github.com/imjohnbo/ok-to-test which would allow members with write access to the repo to trigger this workflow by commenting a PR, but that may defeat the purpose since it requires interaction with each new PR coming in

[nr-kkenney]

haha. liz mentioned this to me while looking over my shoulder and i googled this. should be able to use whats mentioned in this post: https://securitylab.github.com/research/github-actions-preventing-pwn-requests.

[jpvajda]

Thanks @LizBaker I think we can let humans handle these PRs that may fall through the cracks, We all should be actively triaging our issues anyway and we've spent a lot of time on this already. @austin-schaefer to you for final parting words. 🎤

[austin-schaefer]

Hey @jpvajda let's connect in our weekly sync on this, I'm losing the thread abit amidst the slacks and so on. I'm fine if we need manual, but with dozens of PRs coming in a day the toil for the hero is real.

[jpvajda]

@austin-schaefer sure I understand, we have a lot of other use cases for Fork PR routing via github actions, so if we did solve it I think it's something we can use in other places, I just need to get a sense of how much effort is left, and if we can even solve this problem. I'll sync with the team on it.

[jpvajda]

chatted with @nr-kkenney and @LizBaker and this may be resolvable in a small amount of time so we'll move it back to TODO