How to auto merge pr from fork #26874

Janglee123 · 2020-09-16T13:15:23Z

Janglee123
Sep 16, 2020

I have been working on a project like first-contribution. Where newcomers have to commit a new file with their name into the repo. For this, I am trying to make a GitHub action which auto-merge the pr if every check has passed. I am using pascalgn/automerge-action for the same purpose.

It gives Failed to merge PR: Resource not accessible by integration error if someone from outside the organization opens a pr. After reading on the internet I learn that the problem is forks do not have a write permission to the repo and their pr can not get auto merged. PR form the organization’s owner or member get merged automatically but not from an outsider.

After reading this I have ticked first two options under organization settings but it’s still not working and gives the same error.

Thank you.

Answered by kingthorin

Sep 16, 2020

Assuming you mean your “first-bit” repo then you need to use pull_request_target as your on event (vs. pull_request).

For your checkout you want to make sure you checkout the PR content:

    - name: Checkout
      uses: actions/checkout@v2
      with:
        ref: ${{github.event.pull_request.head.ref}}
        repository: ${{github.event.pull_request.head.repo.full_name}}

View full answer

kingthorin · 2020-09-16T15:06:45Z

kingthorin
Sep 16, 2020

What “on” event are you using?

0 replies

kingthorin · 2020-09-16T15:12:35Z

kingthorin
Sep 16, 2020

Assuming you mean your “first-bit” repo then you need to use pull_request_target as your on event (vs. pull_request).

For your checkout you want to make sure you checkout the PR content:

    - name: Checkout
      uses: actions/checkout@v2
      with:
        ref: ${{github.event.pull_request.head.ref}}
        repository: ${{github.event.pull_request.head.repo.full_name}}

0 replies

BrightRan · 2020-09-17T07:57:26Z

BrightRan
Sep 17, 2020

@Janglee123 ,

Yes, I can reproduce the same issue.
I also tried other similar actions that wrap the “Merge a pull request” API, get the same error message “Resource not accessible by integration”.
I directly run the “Merge a pull request” API in the workflow, get the same error message “Resource not accessible by integration”.

Looks like, the feature “Run workflows from fork pull requests” does not work as designed.
I have created an issue ticket (actions/virtual-environments#1609) to report this issue to the appropriate engineering team for further investigation and evaluation.

You can follow this issue ticket and add your comments to it.

0 replies

jclem · 2020-09-17T21:35:47Z

jclem
Sep 17, 2020

@Janglee123 Hi! Thank you for reporting this. Is the repository you’re trying to merge the pull request into public or private?

0 replies

Janglee123 · 2020-09-19T12:37:09Z

Janglee123
Sep 19, 2020
Author

@jclem Thanks for your interest, The repo is public.

0 replies

jclem · 2020-09-21T13:41:47Z

jclem
Sep 21, 2020

Ah, and I also just saw the accepted answer. We never send secrets to workflows run from the pull_request event on public repo forks. This would allow any user to access your secrets simply by forking the repository and creating a PR that updates the workflow. Instead, @kingthorin is correct that pull_request_target is the correct event to use if you want to do something that requires write access to the repo, such as merging a PR.

However, the “Run workflows from fork pull requests” only applies to private repositories—we have no plans to enable this setting for public repositories due to the potential for stealing secrets and accidentally granting any user write access to the public repository.

Edit Just to be more explicit about why we don’t intend to support this for public repositories—since workflows on the pull_request event run from the merge commit of the pull request, a user could fork an open source repository, update the workflow to echo $SOME_SECRET, and then open a pull request. If that repository had secrets or write tokens enabled, the opener of the PR would be able to write to the repository and read its secrets.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Community

How to auto merge pr from fork #26874

{{title}}

Replies: 6 comments

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

GitHub Community

How to auto merge pr from fork #26874

Janglee123 Sep 16, 2020

Replies: 6 comments

kingthorin Sep 16, 2020

kingthorin Sep 16, 2020

BrightRan Sep 17, 2020

jclem Sep 17, 2020

Janglee123 Sep 19, 2020 Author

jclem Sep 21, 2020

Janglee123
Sep 16, 2020

kingthorin
Sep 16, 2020

kingthorin
Sep 16, 2020

BrightRan
Sep 17, 2020

jclem
Sep 17, 2020

Janglee123
Sep 19, 2020
Author

jclem
Sep 21, 2020