也许这里有人可以帮我。
我一直在试图弄清楚为什么当操作尝试使用版本号标记提交时，我会收到一个 Unhandled error: HttpError: Resource not accessible by integration 错误。
当我从本地机器编辑、提交和推送文件时，Action 的标记步骤失败，但如果我通过 GitHub UI 进行相同的操作，则可以成功构建。
两者都使用相同的 GitHub 帐户完成。
我唯一能发现的区别是，当我从 Web UI 进行操作时，提交被标记为 'Verified'，但当我从本地机器推送时则没有。
下面是 action 文件，非常简单。失败的步骤使用 actions/github-script，使用 GITHUB_TOKEN 进行身份验证，在成功发布后在 repo 中创建一个版本标签。
GITHUB_TOKEN 的权限对于失败和成功的运行来说是“完全相同”的。引号中的“完全相同”是因为结果显然不同。（请参见下面的 Set up job 步骤输出）
所以我的问题是：
- 哪些权限是不同的？
- 是什么导致了这种差异？
- 我如何从操作输出中确定两种情况之间的权限差异，因为
设置作业输出中的GITHUB_TOKEN权限部分要么是错误的，要么是不完整的？
目前，我通过使用以下方式给予操作write-all权限来“修复”它：
permissions: write-all
我也可以使用自定义 API 令牌来修复它，但这个问题更多地涉及理解其原因。
操作定义
name: Publish Packages
on:
push:
branches: [ "main" ]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
## some steps omitted for brevity ###
- name: Tag Release
uses: actions/github-script@v6.4.1
with:
script: |
const tagName = '${{ steps.gitversion.outputs.majorMinorPatch }}';
const commitSha = process.env.GITHUB_SHA;
const { owner, repo } = context.repo;
console.log(`Creating new tag: ${tagName}...`);
const tag = await github.rest.git.createRef({
owner: owner,
repo: repo,
ref: `refs/tags/${tagName}`,
sha: commitSha,
});
console.log(`Created new tag: ${tagName}`);
标签发布步骤输出（失败时）
1s
Run actions/github-script@v6.4.1
Creating new tag: 1.1.1...
RequestError [HttpError]: Resource not accessible by integration
at /home/runner/work/_actions/actions/github-script/v6.4.1/dist/index.js:6842:21
at processTicksAndRejections (node:internal/process/task_queues:96:5)
at async eval (eval at callAsyncFunction (/home/runner/work/_actions/actions/github-script/v6.4.1/dist/index.js:15143:16), <anonymous>:10:13)
at async main (/home/runner/work/_actions/actions/github-script/v6.4.1/dist/index.js:15236:20) {
status: 403,
response: {
Error: Unhandled error: HttpError: Resource not accessible by integration
url: 'https://api.github.com/repos/[REDACTED]/git/refs',
status: 403,
headers: {
'access-control-allow-origin': '*',
'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
connection: 'close',
'content-encoding': 'gzip',
'content-security-policy': "default-src 'none'",
'content-type': 'application/json; charset=utf-8',
date: 'Tue, 11 Apr 2023 16:04:59 GMT',
'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
server: 'GitHub.com',
'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
'transfer-encoding': 'chunked',
vary: 'Accept-Encoding, Accept, X-Requested-With',
'x-content-type-options': 'nosniff',
'x-frame-options': 'deny',
'x-github-api-version-selected': '2022-11-28',
'x-github-media-type': 'github.v3; format=json',
'x-github-request-id': '[REDACTED]',
'x-ratelimit-limit': '1000',
'x-ratelimit-remaining': '998',
'x-ratelimit-reset': '1681232100',
'x-ratelimit-resource': 'core',
'x-ratelimit-used': '2',
'x-xss-protection': '0'
},
data: {
message: 'Resource not accessible by integration',
documentation_url: 'https://docs.github.com/rest/reference/git#create-a-reference'
}
},
request: {
method: 'POST',
url: 'https://api.github.com/repos/[REDACTED]/git/refs',
headers: {
accept: 'application/vnd.github.v3+json',
'user-agent': 'actions/github-script octokit-core.js/3.6.0 Node.js/16.16.0 (linux; x64)',
authorization: 'token [REDACTED]',
'content-type': 'application/json; charset=utf-8'
},
body: '{"ref":"refs/tags/1.1.1","sha":"[REDACTED]"}',
request: { agent: [Agent], hook: [Function: bound bound register] }
}
}
GITHUB_TOKEN 权限
Actions: write
Checks: write
Contents: write
Deployments: write
Discussions: write
Issues: write
Metadata: read
Packages: write
Pages: write
PullRequests: write
RepositoryProjects: write
SecurityEvents: write
Statuses: write
标签发布步骤输出（成功时）
步骤输出只是回显标记脚本。
GITHUB_TOKEN 权限（与失败的步骤完全相同！）
GITHUB_TOKEN Permissions
Actions: write
Checks: write
Contents: write
Deployments: write
Discussions: write
Issues: write
Metadata: read
Packages: write
Pages: write
PullRequests: write
RepositoryProjects: write
SecurityEvents: write
Statuses: write
