Authorization error for PR opened from a fork

[Luthaf]

Hello! We are using this action to put the preview link in the PR, but it seems to fail when the PR was opened from a fork, see for example https://github.com/lab-cosmo/equistore/actions/runs/4325090692/jobs/7550783309.

It works fine when the PR branch is on the same repository, and we have permissions: pull-requests: write in our YAML file. Is there anything we can do on our side?

---

The full error is

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/actions/github-script/v6/dist/index.js:6803:21
    at processTicksAndRejections (node:internal/process/task_queues:96:5) {
  status: 403,
  response: {
    url: 'https://api.github.com/repos/lab-cosmo/equistore/pulls/161',
    status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      connection: 'close',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Fri, 03 Mar 2023 16:02:30 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'GitHub.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3',
      'x-github-request-id': 'A041:5D7B:15B9E58:2CC4E11:64021A16',
      'x-ratelimit-limit': '1000',
      'x-ratelimit-remaining': '989',
      'x-ratelimit-reset': '1677860013',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '11',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Resource not accessible by integration',
      documentation_url: 'https://docs.github.com/rest/reference/pulls/#update-a-pull-request'
    }
  },
  request: {
    method: 'PATCH',
    url: 'https://api.github.com/repos/lab-cosmo/equistore/pulls/161',
    headers: {
      accept: 'application/vnd.github.-preview+json',
      'user-agent': 'actions/github-script octokit-core.js/3.6.0 Node.js/16.16.0 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"body":"Fix #98 \\r\\n\\r\\n<!-- readthedocs-preview equistore start -->\\r\\n----\\n:books: Documentation preview :books:: https://equistore--161.org.readthedocs.build/en/161/\\n\\r\\n<!-- readthedocs-preview equistore end -->"}',
    request: { agent: [Agent], hook: [Function: bound bound register] }
  }
}

Ping @PicoCentauri

[Luthaf]

We moved this action to a separate worflow (we where previously using the same one that is building the docs on CI), and it works fine now. For anyone having the same issue, try using a separate worflow, triggered by

on:
  pull_request_target:
    types:
      - opened

[jhlegarreta]

What if the PR has been already opened, but new commits are added or a push is forced? What should be the type?

I have tried a number of possibilities according to the GHA docs and none has worked in https://github.com/SlicerDMRI/whitematteranalysis/pull/155.

Thanks.