Failing to commit to fork in pull requests

[flodolo]

Trying to file an issue, because I feel like there must be a solution, but I've been unable to find it so far.

I want to create an action that runs on specific pull requests (based on the label), and commit changes (i.e. fixes) on the same branch.

I tried with the default settings, and when I try to commit, I get this error

fatal: You are not currently on a branch.
To push the history leading to the current (detached HEAD)
state now, use

    git push origin HEAD:<name-of-remote-branch>

Error: Process completed with exit code 128.

After searching in existing issues, I found the suggestion to clone with ref: ${{ github.head_ref }}. And that works perfectly, but only if the pull request is coming from the same repository. If I try to run it on a pull request coming from a fork, I get this error instead, still in the cloning phase (Fetching the repository):

   /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +refs/heads/test_pr_outside*:refs/remotes/origin/test_pr_outside* +refs/tags/test_pr_outside*:refs/tags/test_pr_outside*
  The process '/usr/bin/git' failed with exit code 1
  Waiting 11 seconds before trying again
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +refs/heads/test_pr_outside*:refs/remotes/origin/test_pr_outside* +refs/tags/test_pr_outside*:refs/tags/test_pr_outside*
  The process '/usr/bin/git' failed with exit code 1
  Waiting 13 seconds before trying again
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +refs/heads/test_pr_outside*:refs/remotes/origin/test_pr_outside* +refs/tags/test_pr_outside*:refs/tags/test_pr_outside*
  Error: The process '/usr/bin/git' failed with exit code 1

If I try adding fetch-depth: 0, the error changes to

Determining the checkout info
  /usr/bin/git branch --list --remote origin/test_pr_outside
  /usr/bin/git tag --list test_pr_outside
  Error: A branch or tag with the name 'test_pr_outside' could not be found

test_pr_outside it's indeed the name of the branch on the fork, but it's clearly not available in origin.

Any suggestion?

[flodolo]

I think I've figured out how to ensure that cloning works even from forks.

      - name: Clone repository
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
          ref: ${{github.event.pull_request.head.ref}}
          repository: ${{github.event.pull_request.head.repo.full_name}}

Working:

• I can commit if the branch comes from the main repository
• I can at least clone if the branch comes from a fork

Not working:

• Commit to the fork's branch.

Even if "Allow changes by maintainers" is enabled (i.e. actions are not enabled on the fork), I get a fatal: unable to access 'fork_repo': The requested URL returned error: 403. Do I need an SSH_KEY to solve that, because the action token is not sufficient?

EDIT: never mind, tried with ssh-key and getting exactly the same error 😔

[namoscato]

I'm also unable to find a way to push commits from a base repository's action to a forked branch.

I've been working with the new pull_request_target event, essentially trying to run a job from the base repository (with base repository secret dependencies) when pull requests are opened from a fork.

I get an error when the job tries to push to the forked branch / HEAD, i.e.

/usr/bin/git push https://github.com/<forked-user>/<repo>.git
  remote: Repository not found.
  fatal: repository 'https://github.com/<forked-user>/<repo>.git/' not found
  Error: The process '/usr/bin/git' failed with exit code 128

and have tried variations that include:

• adding a new remote for the forked repository prior to pushing
• using a personal access token instead of GITHUB_TOKEN

with no luck.

I'm not sure this is an issue with actions/checkout, but this was the only relevant issue I was able to find.

[electrofelix]

Running into a few issues around this as well, I suspect it's a case of needing an example of some run steps required when working in the pull_request_target context.

Doing a push using the following might work a bit better, but I've yet to check if the injected GITHUB_TOKEN can push to hidden refs:

git push origin HEAD:refs/pull/<num>/head

Unfortunately, the GITHUB_TOKEN is rejected from pushing to hidden refs.

[Yehonal]

The pull_request_target works fine for me

I'm using it here: https://github.com/Drassil/action-package-version-bump/blob/main/.github/workflows/test.yml#L9

and it gives the GITHUB_TOKEN write permissions on forks.

[Siddharth-Ashri]

Hi this only seems to work for public repos. Private repos don't seem to work.