资源无法通过集成访问 - Github 操作对于推送提交失败，但对于使用同一帐户通过 Web UI 提交则失败

Question

所以，也许这里有人可以帮助我。

我一直在试图弄清楚为什么Unhandled error: HttpError: Resource not accessible by integration当一个操作尝试用版本号标记提交时我会收到 a 。

当我从本地计算机编辑、提交和推送文件时，操作的标记步骤失败，但如果我通过 GitHub UI 执行相同操作，我会获得成功的构建。

两者都是使用相同的 github 帐户完成的。

我能发现的唯一区别是，当我从网络用户界面执行提交时，提交是“已验证”的，但当我从本地计算机推送时，提交是“已验证”的。

操作文件如下，并非火箭科学。失败的步骤使用actions/github-script，并使用 GITHUB_TOKEN 进行身份验证，在成功发布时在存储库中创建版本标记。

对于失败的运行和成功的运行，GITHUB_TOKEN 权限“完全相同”。“完全相同”用引号引起来，因为结果显然不同。（步骤输出见下文Set up job）

所以我的问题是：

• 有什么不同的权限？
• 是什么导致了这种差异？
• Set up job由于输出中的 GITHUB_TOKEN Permissions 部分存在或不完整，如何从操作输出中判断两种情况之间的权限不同？

现在我已经通过使用以下方法授予操作write-all权限来“修复它” ：

permissions: write-all

我还可以在操作密钥中使用自定义 API 令牌来修复它，但这个问题更多的是关于理解它的原因。

动作定义

name: Publish Packages

on:
  push:
    branches: [ "main" ]
jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3

## some steps omitted for brevity ###

    - name: Tag Release
      uses: actions/github-script@v6.4.1
      with:
        script: |
          const tagName = '${{ steps.gitversion.outputs.majorMinorPatch }}';
          const commitSha = process.env.GITHUB_SHA;
          const { owner, repo } = context.repo;
          console.log(`Creating new tag: ${tagName}...`);
          const tag = await github.rest.git.createRef({
            owner: owner,
            repo: repo,
            ref: `refs/tags/${tagName}`,
            sha: commitSha,
          });
          console.log(`Created new tag: ${tagName}`);

标签释放步骤输出（失败时）

1s
Run actions/github-script@v6.4.1
Creating new tag: 1.1.1...
RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/actions/github-script/v6.4.1/dist/index.js:6842:21
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async eval (eval at callAsyncFunction (/home/runner/work/_actions/actions/github-script/v6.4.1/dist/index.js:15143:16), <anonymous>:10:13)
    at async main (/home/runner/work/_actions/actions/github-script/v6.4.1/dist/index.js:15236:20) {
  status: 403,
  response: {
Error: Unhandled error: HttpError: Resource not accessible by integration
    url: 'https://api.github.com/repos/[REDACTED]/git/refs',
    status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      connection: 'close',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Tue, 11 Apr 2023 16:04:59 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'GitHub.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3; format=json',
      'x-github-request-id': '[REDACTED]',
      'x-ratelimit-limit': '1000',
      'x-ratelimit-remaining': '998',
      'x-ratelimit-reset': '1681232100',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '2',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Resource not accessible by integration',
      documentation_url: 'https://docs.github.com/rest/reference/git#create-a-reference'
    }
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/[REDACTED]/git/refs',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'actions/github-script octokit-core.js/3.6.0 Node.js/16.16.0 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"ref":"refs/tags/1.1.1","sha":"[REDACTED]"}',
    request: { agent: [Agent], hook: [Function: bound bound register] }
  }
}

GITHUB_TOKEN 权限

  Actions: write
  Checks: write
  Contents: write
  Deployments: write
  Discussions: write
  Issues: write
  Metadata: read
  Packages: write
  Pages: write
  PullRequests: write
  RepositoryProjects: write
  SecurityEvents: write
  Statuses: write

标签释放步骤输出（成功时）

步骤输出只是回显标记脚本。

GITHUB_TOKEN 权限（与失败的步骤完全相同！）

GITHUB_TOKEN Permissions
  Actions: write
  Checks: write
  Contents: write
  Deployments: write
  Discussions: write
  Issues: write
  Metadata: read
  Packages: write
  Pages: write
  PullRequests: write
  RepositoryProjects: write
  SecurityEvents: write
  Statuses: write

我在调查过程中发现的一些链接

• GITHUB_TOKEN 的权限
• 动作安全强化
• 提交签名验证

Answer 1

就我而言，操作失败是因为我没有在存储库中授予它们写入权限。

为此，请转到您的存储库settings page->actions

将workflows permissions其更改为read and write permissions如果不是这个。