403 on Contributor-owned MR

[arsdehnel]

I mentioned this over in #3 but @rossjrw said that it should work so I'm starting a discussion here. I'm getting a 403 on the latest build of this PR. The logs are here for it, the error posted here:

/usr/bin/git push --porcelain ***github.com/DorothyToth/dorothytoth.git github-pages-deploy-action/ip92c6mz1:main
remote: Permission to DorothyToth/dorothytoth.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/DorothyToth/dorothytoth.git/': The requested URL returned error: 403
Running post deployment cleanup jobs… 🗑️
/usr/bin/git checkout -B github-pages-deploy-action/ip92c6mz1
Reset branch 'github-pages-deploy-action/ip92c6mz1'
/usr/bin/chmod -R +rw github-pages-deploy-action-temp-deployment-folder
/usr/bin/git worktree remove github-pages-deploy-action-temp-deployment-folder --force
Error: The deploy step encountered an error: remote: Permission to DorothyToth/dorothytoth.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/DorothyToth/dorothytoth.git/': The requested URL returned error: 403 ❌
Notice: Deployment failed! ❌

I had the owner check the Settings for me and this is what she sent me:

Not sure exactly what is missing here, feeling like I am missing a permission or something but can't figure out what it is.

[rossjrw]

The setting that determines whether the repo's token has permission to edit files in the repo is just below the cutoff of that screenshot, under 'Workflow permissions' - could you verify that that is set to 'Read and write permissions'?

In addition to that, the workflow file can further restrict the scope of the permissions. You've got this in yours:

https://github.com/DorothyToth/dorothytoth/blob/8597a9bb8fd6c3a25043eb4f3f9cd7f1dee8c9e2/.github/workflows/preview.yml#L15-L18

permissions:
  contents: read
  pages: write
  id-token: write

which explicitly sets the content permission to 'read', not 'write'. At the very least you would need content: write for the deployment and pull-requests: write for the sticky comment. I am not clear on what the pages permission does, docs imply it is about adminstrating Pages sites (e.g. changing the URL / SSH) and it doesn't look like OpenID is used in this workflow, so I would remove the permission entry outright to fall back to the repo default.