Updating PRs from apply fails for renovate pull requests

[florianmutter]

Question

When merging a PR updating some of the open PRs fails with the following errors:

===> Update PR 19976
gh: user doesn't have permission to update head repository (HTTP 403)
===> Update PR 19947
gh: user doesn't have permission to update head repository (HTTP 403)
===> Update PR 19944
gh: user doesn't have permission to update head repository (HTTP 403)
===> Update PR 19936
gh: user doesn't have permission to update head repository (HTTP 403)
***"message":"user doesn't have permission to update head repository","documentation_url":"https://docs.github.com/rest/pulls/pulls#update-a-pull-request-branch"***"message":"user doesn't have permission to update head repository","documentation_url":"https://docs.github.com/rest/pulls/pulls#update-a-pull-request-branch"***"message":"user doesn't have permission to update head repository","documentation_url":"https://docs.github.com/rest/pulls/pulls#update-a-pull-request-branch"***"message":"user doesn't have permission to update head repository","documentation_url":"https://docs.github.com/rest/pulls/pulls#update-a-pull-request-branch"***

All those PRs are from renovate bot that we also run as a GitHub action with it's own app. We have seen the same issue with PRs that were created by Dependabot. The app that tfaction uses has the following permissions:

✅ Read access to actions, members, and metadata
✅ Read and write access to code, issues, and pull requests

Has someone seen this before? It seems that one app does not have permissions to update PRs from other apps.

Background of the question

No response

Example Code

No response

Note

No response

[suzuki-shunsuke]

Hmm.
About the permission, pull_requests: write and contents: write are enough.
Maybe Dependabot doesn't have these permissions.

https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#responding-to-events

GITHUB_TOKEN has read-only permissions by default.

Or are your renovate pull request branches protected by branch protection rules?

[suzuki-shunsuke]

Oh, maybe I misunderstood.
You try to update branches using a GitHub token issued by a GitHub App, and the token should have the permission pull_requests: write and contents: write, right?

Could you share the code like this?

[florianmutter]

This is our code:

      - name: Generate token for apply
        id: apply_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
        with:
          app_id: '${{vars.NRP_BOT_APP_ID}}'
          private_key: '${{secrets.NRP_BOT_APP_PRIVATE_KEY}}'
          # pull_requests:write - Post comments
          # actions:read - Download plan files
          # issues:write - Update drift issues
          permissions: >-
            {
              "pull_requests": "write",
              "actions": "read",
              "issues": "write"
            }
          repositories: >-
            [
              "${{github.event.repository.name}}"
            ]

      - uses: suzuki-shunsuke/tfaction/apply@fb618c210657d13dd7de8e818ac13f5fab702185 # v1.1.1-1
        with:
          github_token: ${{ steps.apply_token.outputs.token }}

I just noticed there was an update: suzuki-shunsuke/tfaction-example#2277 We will try with adding the contents: write permission.

[florianmutter]

This did fix the issue! Thanks!