Error when using workflow: ”The nested job 'genmatrix' is requesting 'pull-requests: read'“

[martinheise]

Module version(s) affected

^1.9

Description

I have used the workflow as described with default setup pointing to tag “v1”, both in a new repository and in an older one (both containing Silverstripe modules):

• https://github.com/martinheise/silverstripe-download-codes
• https://github.com/martinheise/silverstripe-responsiveimages

For both I get an error message now when running the CI workflow related to permission (details see below).

As the older repository used to work this way without code changes in the meantime, I tried several configurations using different tags – it seems the issue appears with branch 1.9, while 1.8. still runs fine.

How to reproduce

Setup a basic CI workflow as described on https://github.com/silverstripe/gha-ci/ in some repository:

name: CI

on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  ci:
    name: CI
    uses: silverstripe/gha-ci/.github/workflows/ci.yml@v1

and trigger the CI action manually or by pushing a branch.

The action aborts with error message:

The workflow is not valid. .github/workflows/ci.yml (Line: 9, Col: 3): Error calling workflow 'silverstripe/gha-ci/.github/workflows/ci.yml@v1'. The nested job 'genmatrix' is requesting 'pull-requests: read', but is only allowed 'pull-requests: none'. .github/workflows/ci.yml (Line: 9, Col: 3): Error calling workflow 'silverstripe/gha-ci/.github/workflows/ci.yml@v1'. The nested job 'patchrelease' is requesting 'contents: write', but is only allowed 'contents: read'.

Changing the referenced tag/branch for the included job to e.g.:

silverstripe/gha-ci/.github/workflows/ci.yml@1.8

Using branch 1.8 here still works and the job runs successfully, new branches 1.9, 1.10, 1.11, 1.12 fail with the same message.

Possible Solution

I’m not sure if this about wrong permission inside gha-ci module, or if some different setup in the repository using it is required because of some change – in the latter case just the documentation would need enhancement.

Additional Context

Thanks for checking!

Validations

• Check that there isn't already an issue that reports the same bug
• Double check that your reproduction steps work in a fresh installation of silverstripe/installer (with any code examples you've provided)

Notes

• See DOC Add note about permissions to readme #138 (comment) - we're opting to split the patch tagging as its own workflow, so we can have contents:read instead of contents:write in the ci.yml workflow.

PRs

• NEW Add gauge release and dispatching gha-auto-tag. gha-tag-release#25
• NEW Add workflow for tagging patch releases module-standardiser#66

After merging, reassign to Guy so they can do these steps

• Set default branch for gha-tag-release to 2
• Manually tag 2.0.0 of gha-tag-release
• Manually tag v2 of gha-tag-release
• Run module standardiser against the next-patch branch

Next set of PRs

Important

DO NOT merge these until the PRs above are merged, and the steps above are complete.

• MNT Run module-standardiser bringyourownideas/silverstripe-maintenance#232
• MNT Run module-standardiser bringyourownideas/silverstripe-composer-update-checker#92
• MNT Run module-standardiser silverstripe-gridfield-bulk-editing-tools#298
• MNT Run module-standardiser cwp-agencyextensions#129
• MNT Run module-standardiser cwp-starter-theme#259
• MNT Run module-standardiser cwp-watea-theme#195
• MNT Run module-standardiser developer-docs#548
• MNT Run module-standardiser silverstripe-elemental#1227
• MNT Run module-standardiser silverstripe-elemental-userforms#96
• MNT Run module-standardiser silverstripe-admin#1803
• MNT Run module-standardiser silverstripe-asset-admin#1478
• MNT Run module-standardiser silverstripe-assets#623
• MNT Run module-standardiser silverstripe-auditor#87
• MNT Run module-standardiser silverstripe-blog#771
• MNT Run module-standardiser silverstripe-campaign-admin#317
• MNT Run module-standardiser silverstripe-cms#2979
• MNT Run module-standardiser silverstripe-config#119
• MNT Run module-standardiser silverstripe-contentreview#246
• MNT Run module-standardiser silverstripe-documentconverter#91
• MNT Run module-standardiser silverstripe-elemental-bannerblock#157
• MNT Run module-standardiser silverstripe-elemental-fileblock#58
• MNT Run module-standardiser silverstripe-environmentcheck#109
• MNT Run module-standardiser silverstripe-errorpage#114
• MNT Run module-standardiser silverstripe-externallinks#137
• MNT Run module-standardiser silverstripe-framework#11317
• MNT Run module-standardiser silverstripe-graphql#595
• MNT Run module-standardiser silverstripe-gridfieldqueuedexport#117
• MNT Run module-standardiser silverstripe-hybridsessions#110
• MNT Run module-standardiser silverstripe-iframe#92
• MNT Run module-standardiser silverstripe-installer#376
• MNT Run module-standardiser silverstripe-ldap#85
• MNT Run module-standardiser silverstripe-linkfield#311
• MNT Run module-standardiser silverstripe-lumberjack#162
• MNT Run module-standardiser silverstripe-mimevalidator#81
• MNT Run module-standardiser silverstripe-realme#152
• MNT Run module-standardiser silverstripe-session-manager#206
• MNT Run module-standardiser recipe-authoring-tools#39
• MNT Run module-standardiser recipe-blog#56
• MNT Run module-standardiser recipe-cms#89
• MNT Run module-standardiser recipe-collaboration#35
• MNT Run module-standardiser recipe-content-blocks#45
• MNT Run module-standardiser recipe-core#98
• MNT Run module-standardiser recipe-form-building#38
• MNT Run module-standardiser recipe-plugin#45
• MNT Run module-standardiser recipe-reporting-tools#47
• MNT Run module-standardiser recipe-services#38
• MNT Run module-standardiser recipe-kitchen-sink#68
• MNT Run module-standardiser silverstripe-registry#102
• MNT Run module-standardiser silverstripe-reports#190
• MNT Run module-standardiser silverstripe-restfulserver#131
• MNT Run module-standardiser silverstripe-securityreport#85
• MNT Run module-standardiser silverstripe-segment-field#119
• MNT Run module-standardiser silverstripe-sharedraftcontent#246
• MNT Run module-standardiser silverstripe-siteconfig#170
• MNT Run module-standardiser silverstripe-sitewidecontent-report#100
• MNT Run module-standardiser silverstripe-spamprotection#122
• MNT Run module-standardiser silverstripe-staticpublishqueue#198
• MNT Run module-standardiser silverstripe-subsites#585
• MNT Run module-standardiser silverstripe-tagfield#300
• MNT Run module-standardiser silverstripe-taxonomy#120
• MNT Run module-standardiser silverstripe-textextraction#99
• MNT Run module-standardiser silverstripe-userforms#1310
• MNT Run module-standardiser vendor-plugin#80
• MNT Run module-standardiser silverstripe-versioned#457
• MNT Run module-standardiser silverstripe-versioned-admin#355
• MNT Run module-standardiser silverstripe-versionfeed#116
• MNT Run module-standardiser silverstripe-simple#86
• MNT Run module-standardiser silverstripe-advancedworkflow#542
• MNT Run module-standardiser silverstripe-gridfieldextensions#409
• MNT Run module-standardiser symbiote/silverstripe-multivaluefield#115
• MNT Run module-standardiser silverstripe-queuedjobs#438
• MNT Run module-standardiser tractorcow-farm/silverstripe-fluent#868
• MNT Run module-standardiser silverstripe-mfa#554
• MNT Run module-standardiser silverstripe-totp-authenticator#168
• MNT Run module-standardiser silverstripe-webauthn-authenticator#192
• MNT Run module-standardiser silverstripe-login-forms#192
• MNT Run module-standardiser silverstripe-dynamodb#68
• MNT Run module-standardiser #142
• MNT Run module-standardiser recipe-testing#23
• MNT Run module-standardiser silverstripe-behat-extension#278
• MNT Run module-standardiser cow#259
• MNT Run module-standardiser module-standardiser#67
• MNT Run module-standardiser silverstripe-tx-translator#33
• MNT Run module-standardiser markdown-php-codesniffer#11
• MNT Run module-standardiser silverstripe-standards#10
• MNT Run module-standardiser documentation-lint#8
• MNT Run module-standardiser supported-modules#39
• MNT Run module-standardiser webpack-config#77
• MNT Run module-standardiser api.silverstripe.org#120
• MNT Run module-standardiser silverstripe-userhelp-content#185
• MNT Run module-standardiser gha-action-ci#11
• MNT Run module-standardiser gha-add-pr-to-project#10
• MNT Run module-standardiser gha-auto-tag#21
• MNT Run module-standardiser gha-dispatch-ci#17
• MNT Run module-standardiser gha-gauge-release#12
• MNT Run module-standardiser gha-generate-matrix#100
• MNT Run module-standardiser gha-issue#13
• MNT Run module-standardiser gha-keepalive#15
• MNT Run module-standardiser gha-merge-up#41
• MNT Run module-standardiser gha-pull-request#15
• MNT Run module-standardiser gha-run-tests#34
• MNT Run module-standardiser gha-tag-release#26
• MNT Run module-standardiser gha-trigger-ci#9
• MNT Run module-standardiser gha-update-js#29
• MNT Run module-standardiser gha-action-ci#12
• MNT Run module-standardiser gha-auto-tag#22
• MNT Run module-standardiser #143
• MNT Run module-standardiser gha-dispatch-ci#18
• MNT Run module-standardiser gha-generate-matrix#101
• MNT Run module-standardiser gha-issue#14
• MNT Run module-standardiser gha-keepalive#16
• MNT Run module-standardiser gha-merge-up#42
• MNT Run module-standardiser gha-pull-request#16
• MNT Run module-standardiser gha-run-tests#35
• MNT Run module-standardiser gha-tag-release#27
• MNT Run module-standardiser gha-trigger-ci#10
• MNT Run module-standardiser gha-update-js#30
• MNT Run module-standardiser markdown-php-codesniffer#12
• MNT Run module-standardiser silverstripe-standards#11
• MNT Run module-standardiser documentation-lint#9
• ENH Dispatch patch tag workflow instead of running directly #139
• ENH Dispatch patch tag workflow instead of running directly gha-action-ci#10
• ENH Use v2 of the tag-release action gha-auto-tag#20
• ENH Remove gha-gauge-release supported-modules#38
• Several improvements module-standardiser#68

After this set of PRs is merged, reassign to Guy to:

• Tag new minor releases for the various affected gha repos
• Redeploy elvis so it picks up on the changes
• Archive gha-gauge-release

[GuySartorelli]

Looks like the relatively recent security hardening has resulted in the default GitHub token that your repository uses for GitHub Actions not having enough permission to run the workflow. I don't think this was an intended side effect.

You'll need to make the following changes for the CI to run:

 name: CI

 on:
   push:
   pull_request:
   workflow_dispatch:
+
+ permissions: {}

 jobs:
   ci:
     name: CI
     uses: silverstripe/gha-ci/.github/workflows/ci.yml@v1
+    permissions:
+      pull-requests: read
+      contents: write

The contents: write is a bit unfortunate - that is required by silverstripe/gha-tag-release which will be skipped in your repos, so that permission won't ever actually be used. Nevertheless GitHub requires that it's provided.

To ensure you protect yourself from malicious actors, I recommend you set the "Fork pull request workflows from outside collaborators" setting in https://github.com/<org>/<repo>/settings/actions to one of

• Require approval for first-time contributors
• Require approval for all outside collaborators

I'll work on getting the README here updated, but for now hopefully that gives you a way forward.

[martinheise]

Thanks, @GuySartorelli, these changes work fine to fix the issue.

[GuySartorelli]

Sweet. FYI we're working on an improvement that will allow you to just have contents: read instead of giving it write permissions.

[emteknetnz]

^ I think you won't even need to specify contents: read after the improvements? The default github token in repos provides read level access.

[x] Read repository contents and packages permissions
Workflows have read permissions in the repository for the contents and packages scopes only.