Skip to content

fix: update permissions for welcome workflow to avoid 403 error #181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
google-oss-prow merged 5 commits into from
Nov 26, 2025
Merged

fix: update permissions for welcome workflow to avoid 403 error #181

google-oss-prow merged 5 commits into from
Nov 26, 2025

Conversation

@aniketpati1121
Copy link
Contributor

@aniketpati1121 aniketpati1121 commented Nov 25, 2025 •
edited
Loading

This PR fixes the 403 "Resource not accessible by integration" error
in the "Welcome new contributors" workflow.

Changes:

  • Updated contents permission from read to write
  • Ensured pull_requests and issues have proper write access

This allows the actions/first-interaction action to successfully post
welcome comments on new issues and PRs.

fixes #179

@aniketpati1121
fix: update permissions for welcome workflow to avoid 403 errors
1ebf6f3 
Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
@aniketpati1121
Merge branch 'main' into chore/fix-welcome-workflow
8672d5f 
Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
@coveralls
Copy link

coveralls commented Nov 25, 2025 •
edited
Loading

Pull Request Test Coverage Report for Build 19715244518

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 66.578%
Totals Coverage Status
Change from base Build 19671581001: 0.0%
Covered Lines: 2504
Relevant Lines: 3761
💛 - Coveralls

andreyvelich
andreyvelich reviewed Nov 25, 2025
View reviewed changes
.github/workflows/welcome-new-contributors.yaml Outdated
Comment on lines 18 to 21
permissions:
contents: write
pull-requests: write
issues: write
Copy link
Member

@andreyvelich andreyvelich Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @aniketpati1121!
I think @kramaranya originally tried to use PR target, but it doesn't work: #82

Did we miss the contents: write permission?

Copy link
Contributor Author

@aniketpati1121 aniketpati1121 Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @aniketpati1121! I think @kramaranya originally tried to use PR target, but it doesn't work: #82

Did we miss the contents: write permission?

Thanks @andreyvelich! Yes, we added contents: write permission and updated the workflow to use pull_request_target, so it should now successfully post comments on new PRs and issues.

Copy link
Member

@andreyvelich andreyvelich Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you need to remove the permission at the Workflow level (e.g. L11-L13)?

Copy link
Contributor Author

@aniketpati1121 aniketpati1121 Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are only using job-level permissions under welcome job, so no workflow-level permissions are set. This should be sufficient for the action to post comments successfully.

Copy link
Member

@andreyvelich andreyvelich Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SGTM, can you remove these lines in your PR:

sdk/.github/workflows/welcome-new-contributors.yaml

Lines 11 to 14 in 8672d5f

permissions:
issues: write
pull-requests: write
?

Copy link
Contributor

@kramaranya kramaranya Nov 25, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, that might work. I'm thinking whether we should just add contents: write at the workflow level instead and keep other permissions there as well? Similar to https://github.com/HugoBlox/hugo-blox-builder/blob/0ef515fbaeeda95259fa77e817b4538e84bf6a9e/.github/workflows/community-welcome.yml#L12-L15 and https://github.com/actions/first-interaction/blob/main/README.md?plain=1#L39-L41

Copy link
Contributor Author

@aniketpati1121 aniketpati1121 Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please let me know if anything else is needed.

Copy link
Member

@andreyvelich andreyvelich Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aniketpati1121 Can you move contents: write to the workflow level permission (e.g. L40)?

Copy link
Contributor Author

@aniketpati1121 aniketpati1121 Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aniketpati1121 Can you move contents: write to the workflow level permission (e.g. L40)?

Updated the workflow by moving contents: write to the workflow-level permissions

@aniketpati1121
fix: remove unnecessary permissions, keep only contents: write
3ae13ce 
Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
@aniketpati1121
fix: move contents: write to workflow-level permissions
41c31e2 
Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
@aniketpati1121
fix: replace pull_request with pull_request_target
0d56b62 
Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
@andreyvelich
Copy link
Member

andreyvelich commented Nov 26, 2025

Thanks @aniketpati1121!
/lgtm
/approve

@google-oss-prow google-oss-prow bot added the lgtm label Nov 26, 2025
@google-oss-prow
Copy link

google-oss-prow bot commented Nov 26, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andreyvelich

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@google-oss-prow google-oss-prow bot merged commit 53e744e into kubeflow:main Nov 26, 2025
13 of 14 checks passed
@google-oss-prow google-oss-prow bot added this to the v0.3 milestone Nov 26, 2025
rohansaibuddhi pushed a commit to rohansaibuddhi/kubeflow-sdk that referenced this pull request Dec 11, 2025
@aniketpati1121 @rohansaibuddhi
fix: update permissions for welcome workflow to avoid 403 error (kube…
701b38b 
…flow#181)

* fix: update permissions for welcome workflow to avoid 403 errors

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>

* fix: remove unnecessary permissions, keep only contents: write

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>

* fix: move contents: write to workflow-level permissions

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>

* fix: replace pull_request with pull_request_target

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>

---------

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
Shekharrajak pushed a commit to Shekharrajak/sdk that referenced this pull request Jan 13, 2026
@aniketpati1121
fix: update permissions for welcome workflow to avoid 403 error (kube…
7e15025 
…flow#181)

* fix: update permissions for welcome workflow to avoid 403 errors

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>

* fix: remove unnecessary permissions, keep only contents: write

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>

* fix: move contents: write to workflow-level permissions

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>

* fix: replace pull_request with pull_request_target

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>

---------

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andreyvelich andreyvelich andreyvelich left review comments

@kramaranya kramaranya Awaiting requested review from kramaranya

@szaher szaher Awaiting requested review from szaher

Assignees

@andreyvelich andreyvelich

Labels

approved lgtm size/XS

Projects

None yet

Milestone

v0.3

Development

Successfully merging this pull request may close these issues.

Welcome new contributors workflow fails with 403 when posting comments

4 participants

@aniketpati1121 @coveralls @andreyvelich @kramaranya