Does not work when called from a fork

[Ecco]

1. Install comment-on-pr on repository foo/bar (Repo named bar of user foo)
2. As user john, fork foo/bar into john/bar
3. As user john, submit a PR to project foo/bar
4. Failure

   /usr/local/bundle/gems/octokit-4.18.0/lib/octokit/response/raise_error.rb:16:
   in `on_complete': POST https://api.github.com/repos/foo/bar/issues/1/comments:
   403 - Resource not accessible by integration
   // See: https://developer.github.com/v3/issues/comments/#create-a-comment
   (Octokit::Forbidden)`

[benwinding]

Unfortunately, It looks like this is expected behaviour, as secrets are not available to the actions that run on forked PRs. Even in the pull_request.close event, secrets are not available...

It's very annoying as I want to post a comment on a forked pull-request once it's merged... anyone have any work-arounds?

[Ecco]

Well, that's a major limitation of GitHub actions. Actually they're close to being useless.

Here's the details:

• Working using PR from a fork is really GitHub's core strength, and I would say pretty much the standard way of contributing to projects on GitHub.
• GitHub doesn't want to "leak secrets" to third parties (forks), so they don't allow acting on the "main" repository when the action is run from a fork. As a result, they simply prevent those action from doing anything to the "final" repository. I understand the problem, but their solution is terrible.

Long story short: GitHub's limitation. No workaround possible.

Links:

• https://github.community/t5/GitHub-Actions/Token-permissions-for-forks-once-again/m-p/33839
• https://github.com/actions/labeler/issues/12
• https://dev.to/derberg/github-actions-when-fascination-turns-into-disappointment-4d75

[Ecco]

Pleas see this comprehensive description I wrote on GitHub Community that explains the whole problem. Feel free to upvote it to raise awareness 😄

[per1234]

@aaronklaassen I suggest documenting this limitation.