search

grafana / helm-charts

Apache License 2.0
1.67k stars 2.28k forks source link

Add missing permissions in update-helm-repo workflow #3383

Closed narqo closed 3 weeks ago

narqo commented 3 weeks ago

This is the fixup for #3366

The changes in #3366 added an explicit list of permissions, the workflow intents to use. It seems that this broke the release of Helm charts in Mimir. The "Push release tag on origin" now fails with the following:

Pushing tag mimir-distributed-5.6.0-weekly.314
remote: Permission to grafana/mimir.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/grafana/mimir/': The requested URL returned error: 403
Error: Process completed with exit code 128.

(refer to this failed build)

If I understand it right, even though we add all necessary permissions in the repo's "Workflow permissions" settings, the permissions explicitly defined in workflow's YAML override those (refer to github docs). And since the workflow doesn't list the contents: write, the action, that executes the workflow cannot push the tag. This PR fixes that.

narqo commented 3 weeks ago

Note that we also need the repo's admin to add grafana/mimir write access to the mimir-distributed package in this repository.

Right now, with the fixes from this PR, the CI job fails when it pushes the OCI package:

helm push "/home/runner/work/mimir/mimir/.cr-release-packages/mimir-distributed-5.6.0-weekly.314.tgz" "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/helm-charts"

Error: unexpected status from POST request to https://ghcr.io/v2/grafana/helm-charts/mimir-distributed/blobs/uploads/: 403 Forbidden

I've found this explanation of the problem.