Error delete _state: [403] Resource not accessible by integration

[autoantwort]

Description: If a job has multiple actions/stale steps the creation of the cache fails.

Action version: 9

Platform:

• [x] Ubuntu
• [ ] macOS
• [ ] Windows

Runner type:

• [x] Hosted
• [ ] Self-hosted

Repro steps:
https://github.com/microsoft/vcpkg/blob/master/.github/workflows/stale.yml

Expected behavior: No errors.

Actual behavior: Errors. See https://github.com/microsoft/vcpkg/actions/runs/7750221792

[HarithaVattikuti]

Hello @autoantwort Thank you for creating this issue. We will investigate it and get back to you as soon as we have some feedback.

[ericLemanissier]

Hello, the same error happens in here : https://github.com/conan-io/conan-center-index/actions/runs/7810903828/job/21305055330#step:2:1032

[sophies927]

Hello, I am encountering the same error here: https://github.com/microsoft/onnxruntime/actions/runs/7917906948/job/21615103971#step:2:3615.

[Pil0tXia]

Hi everyone, I'm encountering the same issue at https://github.com/apache/eventmesh/actions/runs/8675497930/job/23788986036 and I hope this log would be helpful to you.

Maybe I would revert back to v8 and see if this problem still exists.

[shmishra99]

Granting actions:write to the stale workflow will allow it to manage issues cache as intended.

[jeremystretch]

This appears to be the same issue described in #1131.

[autoantwort]

Adding actions: write also fixes parts of the problem. The same cache entry is then still used across different cache steps

[ericLemanissier]

Giving actions: write means the workflow has all these permissions and this is way too much, and not acceptable for a lot of projects. https://github.com/actions/cache does not require these permissions, and still manages to save a cache across builds. Could the stale action be refactored to use the same trick as the cache action ? Or could it use the cache action under the hood ?

[suyashgaonkar]

Hi @autoantwort , we did investigation with provided information for the issue. Tried to reproduce the issue with actions/stale v8 and v9 both, and everything seems to be working fine on our end. We did not get the mentioned error Warning: Error delete _state: [403] Resource not accessible by integration. For cache to get generated and getting restored the number of operations happening with Github API should exceed the value set in the operations-per-run (deault:30). If not so then we get "The saved state was not found, the process starts from the first issue."" in the logs. you can refer the following links :- https://github.com/actions/stale?tab=readme-ov-file https://github.com/actions/stale?tab=readme-ov-file#operations-per-run Please let us know if you still need any assistance on this as we see recent runs for the mentioned workflow has no issues in the provided repo too. You can check attached the screenshots for more details.

[autoantwort]

@suyashgaonkar I am still able to reproduce this error. I have created an example repo to reproduce: https://github.com/autoantwort/stale-bot-test The latest actions run there also contains the error delete _state: [403] Resource not accessible by integration: https://github.com/autoantwort/stale-bot-test/actions/runs/11220628709/job/31189212458#step:3:72

[autoantwort]

This is more or less the same as https://github.com/actions/stale/issues/1137

[suyashgaonkar]

Hi @autoantwort , We investigated the issue further based on the information provided and found that the actions:write permission needs to be added to the workflow file to resolve the error. The actions/stale action uses actions/cache behind the scenes and calls the respective GitHub API to handle caching. According to the GitHub API documentation, write access for actions is required to communicate with the API, especially when dealing with deleting cache entries.

You can refer to the following URLs for more details:

Repository permissions for actions

Caching dependencies to speed up workflows

Workflow syntax for GitHub Actions - Permissions

[ericLemanissier]

@suyashgaonkar Maybe you have a take on my earlier remark ?

Giving actions: write means the workflow has all these permissions and this is way too much, and not acceptable for a lot of projects. https://github.com/actions/cache does not require these permissions, and still manages to save a cache across builds. Could the stale action be refactored to use the same trick as the cache action ? Or could it use the cache action under the hood ?

[ericLemanissier]

@autoantwort you probably want to try my proposition from https://github.com/actions/stale/pull/1183. For this, you can replace uses: actions/stale@...with uses: actions/stale@ericLemanissier/patch-2 and remove actions: write from https://github.com/microsoft/vcpkg/blob/master/.github/workflows/stale.yml