🛠 Tooling: Post release action doesn't work after initial release

[johnnyreilly]

Bug Report Checklist

• I have tried restarting my IDE and the issue persists.
• I have pulled the latest main branch of the repository.
• I have searched for related issues and found none that matched my issue.

Overview

Consider this post-release GitHub Action: https://github.com/johnnyreilly/ado-npm-auth-lite/actions/workflows/post-release.yml

After the initial run all subsequent runs fail with this error:

Error: HttpError: Resource not accessible by integration
Error: Resource not accessible by integration

Is this a "me" thing? I don't think I've done anything to that and so I'm wondering if I've stumbled on somthing.

Here's the initial successful run: https://github.com/johnnyreilly/ado-npm-auth-lite/actions/runs/11732080037/job/32683543794

Additional Info

n/a

[JoshuaKGoldberg]

Blugh, release permissions. What a pain. This is something I've been procrastinating finding time to really dig into. #925 and #1045 are relevant here too. Up for figuring this out? 😄

[johnnyreilly]

It's weird - if memory serves I followed the instructions for setting up tokens correctly. And it did work the first time. I might dig into it but tbh the post release workflow is "nice to have" stuff - I can live without it.

But back to my original question:

Is this a "me" thing? I don't think I've done anything to that and so I'm wondering if I've stumbled on somthing.

Are you finding the same issues on your post release workflows as well?

[JoshuaKGoldberg]

@all-contributors please add @johnnyreilly for tool.

🤖 Beep boop! This comment was added automatically by all-contributors-auto-action.
Not all contributions can be detected from Git & GitHub alone. Please comment any missing contribution types this bot missed.
...and of course, thank you for contributing! 💙

[allcontributors]

@JoshuaKGoldberg

I've put up a pull request to add @johnnyreilly! 🎉

[JoshuaKGoldberg]

Oh, sorry, missed this:

Are you finding the same issues on your post release workflows as well?

I haven't had this issue.

[johnnyreilly]

Interesting. I've created 2 projects with CTA in the last 3 months and they both have the issue. Mystery as to why though

[johnnyreilly]

Here's two examples of the initial release working on the first attempt but failing on the second:

• https://github.com/investec/home-run/actions/workflows/post-release.yml
• https://github.com/investec/home-run/actions/workflows/post-release.yml

[johnnyreilly]

It looks that the post-release.yml file needs the following:

permissions:
  issues: write
  pull-requests: write

Thanks to @apexskier for the help!

As to the "succeeds first time, fails after that" he said:

That's expected on first release - the action doesn't do anything on first release so it can't 403. (originally intended because you can have a long backlog of affected issues/PRs and can have some issues due to the volume)

Take a look at https://github.com/johnnyreilly/azdo-npm-auth/actions/runs/12211680069/job/34069255562 to see the permissions approach working:

And look at the history of this action prior to the addition:

Should the following be added to the post-release.yml as standard?

permissions:
  issues: write
  pull-requests: write

[github-actions]

Uh oh! @johnnyreilly, the image you shared is missing helpful alt text. Check #1682 (comment).

Alt text is an invisible description that helps screen readers describe images to blind or low-vision users. If you are using markdown to display images, add your alt text inside the brackets of the markdown image.

Learn more about alt text at Basic writing and formatting syntax: images on GitHub Docs.

[JoshuaKGoldberg]

permissions:
  issues: write
  pull-requests: write

Great, accepting PRs to have this in post-release.yml! ✨

Nice job on the investigation @johnnyreilly. It looks like it was a lot messier than it would have seemed at first.

[github-actions]

🎉 This is included in version v1.77.0 🎉

The release is available on:

• GitHub releases
• npm package (@latest dist-tag)

Cheers! 📦🚀