Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: add necessary permissions to example workflow #31582

Closed
Closed
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -343,13 +343,15 @@ This example workflow uses `gh-actions-cache` to delete up to 100 caches created
```yaml
name: cleanup caches by a branch
on:
pull_request:
pull_request_target:
types:
- closed

jobs:
cleanup:
runs-on: ubuntu-latest
permissions:
actions: write

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

permissions is required regardless of the event if "Read and write permissions" are not selected in the settings(Settings > Actions > General > Actions permissions > Workflow permissions). In other words, it is not relevant to changing pull_request_target.
Therefore, I believe it is more appropriate to make this a separate pull request from #31322 .

This comment was marked as spam.

steps:
- name: Cleanup
run: |
Expand All @@ -369,7 +371,7 @@ jobs:
env:
GH_TOKEN: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
REPO: {% raw %}${{ github.repository }}{% endraw %}
BRANCH: refs/pull/{% raw %}${{ github.event.pull_request.number }}{% endraw %}/merge
BRANCH: {% raw %}${{ github.ref_name }}{% endraw %}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed, using ref_name in workflow_dispatch is the correct approach.
IMG_0161
However, this approach is not correct in this example.
Because, the cache is created for the merge ref (refs/pull/.../merge) when a cache is created by a workflow run triggered on a pull request. Therefore, it will not work correctly with ref_name.
IMG_0162
IMG_0163

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I might have been wrong - ref_name ends up being main/master after merge. We'd need github.head_ref here instead.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you think this would work @Mogyuchi?

Suggested change
BRANCH: {% raw %}${{ github.ref_name }}{% endraw %}
BRANCH: {% raw %}${{ github.head_ref }}{% endraw %}

When I used the existing code, gh actions-cache didn't return anything for me

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@corneliusroemer
If you have tried with workflow_dispatch, then your perception that it does not work is correct. This is because github.head_ref is an empty string in the workflow_dispatch event.

```

Alternatively, you can use the API to automatically list or delete all caches on your own cadence. For more information, see "[AUTOTITLE](/rest/actions/cache#about-the-cache-in-github-actions)."
Expand Down