Read and write permissions for Workflow permissions is grayd out

[hamoid]

Hi! Does anyone know why I can't change this setting? The pr-previews are now failing and I don't remember changing this setting.

[hamoid]

Ah I changed it for the Organization and now I can change it.

[hamoid]

Even if I changed the setting to RW, it still fails like this

Switched to a new branch 'github-pages-deploy-action/tzwod0nvp'
/usr/bin/git commit -m Deploy preview for PR 78 🛫 --quiet --no-verify
Pushing changes… (attempt 1 of 3)
/usr/bin/git push --porcelain ***github.com/prachtsaal/prachtsaal.berlin.git github-pages-deploy-action/tzwod0nvp:gh-pages
remote: Permission to prachtsaal/prachtsaal.berlin.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/prachtsaal/prachtsaal.berlin.git/': The requested URL returned error: 403
Changes committed to the gh-pages branch… 📦
Running post deployment cleanup jobs… 🗑️
/usr/bin/git checkout -B github-pages-deploy-action/tzwod0nvp
Reset branch 'github-pages-deploy-action/tzwod0nvp'
/usr/bin/chmod -R +rw github-pages-deploy-action-temp-deployment-folder
/usr/bin/git worktree remove github-pages-deploy-action-temp-deployment-folder --force
Completed deployment successfully! ✅

Anything odd there?

[rossjrw]

Assuming PR 78 refers to prachtsaal/prachtsaal.berlin#78, that PR originates from a fork. This action doesn't support previews for PRs from forks at this time, and this is stated on the README.

See #6 for an explanation of the security implications of allowing previews from forks. If you're willing to forgo security (which I do not recommend), there are some workaround suggestions in the comments.

To summarise: your PR 78 originates from carabistouille34's fork. The CI runs using the GITHUB_TOKEN from that fork, which doesn't have write access to prachstaal/prachstaal.berlin. If it used the source repo's GITHUB_TOKEN instead, anyone would be able to make a pull request to any repository to add a new Actions workflow that e.g. deletes the repo.

[hamoid]

Ah I see! I think in the past we cloned the repo and created a branch. This time the person forked the repo instead. I didn't realize we had used different approaches.

I will update our documentation to let people know how to have the previews working.

Thank you.

[hamoid]

Would it be possible to display an error message like

You're running pr-preview-action from a fork, which is not supported.

? This would have given me a hint, I wouldn't have asked and less work for the maintainers here :)