PR seems to fail intermittently in GH

[DavidGOrtega]

After lots of successful runs suddenly cml-pr was denied by Github

Error: git push --set-upstream origin master-cml-pr-c0b511b4
	
	To https://github.com/DavidGOrtega/fashion_mnist
 ! [remote rejected] master-cml-pr-c0b511b4 -> master-cml-pr-c0b511b4 (refusing to allow a GitHub App to create or update workflow `.github/workflows/cml.yaml` without `workflows` permission)
error: failed to push some refs to 'https://github.com/DavidGOrtega/fashion_mnist'

    at /usr/lib/node_modules/@dvcorg/cml/src/utils.js:14:27
    at ChildProcess.exithandler (child_process.js:315:5)
    at ChildProcess.emit (events.js:314:20)
    at maybeClose (internal/child_process.js:1022:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5)

[0x2b3bfa0]

This only happens when you include files from .github/workflows in your desired changes. You can try to avoid including modified workflow files in your cml-pr pull requests ~or, perhaps, granting additional permissions to the temporary token~.

[DavidGOrtega]

Why do you think thats the case? In the workflow I just see cml-pr pushing the content of output

cml-pr --md output/* >> report.md

[0x2b3bfa0]

[...] refusing to allow a GitHub App to create or update workflow .github/workflows/cml.yaml without workflows permission (from your error above)

It looks like .github/workflows/cml.yaml is getting somehow added and committed to the pull request branch before pushing (?)

[DavidGOrtega]

I would say no. Here is the original error:

https://github.com/DavidGOrtega/fashion_mnist/runs/3199847730?check_suite_focus=true

It happened when the original branch committed a workflow file. however cml-pr should just only add output folder files

[0x2b3bfa0]

workflows — Grants the ability to add and update GitHub Actions workflow files. Workflow files can be committed without this scope if the same file (with both the same path and contents) exists on another branch in the same repository. Workflow files can expose GITHUB_TOKEN which may have a different set of scopes.

As per the GitHub documentation, pushing a new branch with exactly the same workflows as an existing branch shouldn't trigger this error. 🤔 Maybe it's a GitHub bug?

[0x2b3bfa0]

The only case where this could happen is when you modify a workflow in the target branch after the checkout but before cml-pr 🤔

[0x2b3bfa0]

@DavidGOrtega, can you update your tokens and run again 3199847730? It looks like they've expired.

[DavidGOrtega]

Im hitting this error in my fashion_mnist repo in two times in the last three commits:

• 3/3 modifying the workflow file
• 3/3 using the same api token
• 2 that failed shares fetch-depth: 0 in the checkout step

[dacbd]

When workflows are modified certain actions are not allowed when using action provided tokens for operations