Personal tap publish fails du to GitHub API Error (HOMEBREW_GITHUB_API_TOKEN)

[a4z]

Output of brew config

n/a, git hub action question

Output of brew doctor

n/a, git hub action question

Description of issue

I am nearly done with my first tap, but the publish action fails with

Error: GitHub API Error: Resource not accessible by integration
HOMEBREW_GITHUB_API_TOKEN may be invalid or expired; check:

I guess the reason is related to that generate block

          HOMEBREW_GITHUB_API_TOKEN: ${{ github.token }}
          HOMEBREW_GITHUB_PACKAGES_TOKEN: ${{ github.token }}
          HOMEBREW_GITHUB_PACKAGES_USER: ${{ github.actor }}

Should ${{ github.token }} not exist and be usable?

I am now a little bit lost if this is a Github / repo setting I need to change, and if, which one, or if that is something in the action to customize.

Do I need to generate a token and set an environment variable or name a token?

(I hope this is the last hurdle to take for my first tap, sorry for the many questions I have)

[ZhongRuoyu]

This is an issue with ${{ github.token }}'s permissions. Can you try setting the following permissions in the workflow, and then re-add the pr-pull tag:

permissions:
  actions: read
  contents: write
  pull-requests: write

For more information: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token

[ZhongRuoyu]

Can you try committing the workflow changes to the main branch first? The pull_request_target event runs in the context of the base of the pull request (GitHub Docs), so the permission changes did not take effect (see logs).

[a4z]

That worked, kind of, I got mail about new artifacts.

But the pipeline stuck now for 15 minutes in the push commit stage, and still no outbut. That seems long
https://github.com/a4z/homebrew-cpp-taps/actions/runs/4864257468/jobs/8673051259?pr=3

[a4z]

oh, I added branch protection for main, need to remove that

[ZhongRuoyu]

Yes, it seems to be due to your branch protection rule. You can try disabling the branch protection rule, or the following as a workaround. (Disabling branch protection rule doesn't sound like a good workaround so I didn't mention that at first. There is definitely an area of improvement in the workflow.)

---

My original comment:

Can you try the following workaround, i.e., replace branch: main with branch: ${{ github.head_ref }}, and remove the "Delete branch" step:

--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -35,10 +35,4 @@ jobs:
         uses: Homebrew/actions/git-try-push@master
         with:
           token: ${{ github.token }}
-          branch: main
-
-      - name: Delete branch
-        if: github.event.pull_request.head.repo.fork == false
-        env:
-          BRANCH: ${{ github.event.pull_request.head.ref }}
-        run: git push --delete origin $BRANCH
+          branch: ${{ github.head_ref }}

Similarly, you will need to commit the changes to main first. This will try to push the bottle commit to your branch and you will need to merge the PR manually.

[a4z]

I just removed the protection for now. I think that's fine. I added it more because I am used to it.
I can figure out how that works in the future.

I had to remove the previous release, and now everything has gone through, and I have my first success.

Thank you so much for your help!