response returned 403 from POST (`thread-comments` for a PR)

[quqiOnfree]

What events trigger your workflow?

on:
  pull_request:
    branches: [main, master, develop]
    paths: ['**.c', '**.cpp', '**.h', '**.hpp', '**.cxx', '**.hxx', '**.cc', '**.hh', '**CMakeLists.txt', 'meson.build', '**.cmake']
  push:
    branches: [main, master, develop]
    paths: ['**.c', '**.cpp', '**.h', '**.hpp', '**.cxx', '**.hxx', '**.cc', '**.hh', '**CMakeLists.txt', 'meson.build', '**.cmake']

permissions:
  pull-requests: write

What OS does your workflow use?

runs-on: ubuntu-latest

How is cpp-linter-action configured?

- uses: cpp-linter/cpp-linter-action@v2
        id: linter
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          style: 'file'
          tidy-checks: ''
          extra-args: '-std=c++23'
          thread-comments: ${{ github.event_name == 'pull_request' && 'update' }}

What was the unexpected behavior?

When I pull request, the error occurred at creating an issue comment

ERROR:CPP Linter:response returned 403 from POST https://api.github.com/repos/Hcolda/QChatServer/issues/45/comments with message: {"message":"Resource not accessible by integration","documentation_url":"https://docs.github.com/rest/issues/comments#create-an-issue-comment","status":"403"}
  Traceback (most recent call last):
    File "/home/runner/work/_actions/cpp-linter/cpp-linter-action/v2/.venv/bin/cpp-linter", line 10, in <module>
      sys.exit(main())
               ^^^^^^
    File "/home/runner/work/_actions/cpp-linter/cpp-linter-action/v2/.venv/lib/python3.12/site-packages/cpp_linter/__init__.py", line 81, in main
      rest_api_client.post_feedback(files=files, args=args, clang_versions=clang_versions)
    File "/home/runner/work/_actions/cpp-linter/cpp-linter-action/v2/.venv/lib/python3.12/site-packages/cpp_linter/rest_api/github_api.py", line 264, in post_feedback
      self.update_comment(
    File "/home/runner/work/_actions/cpp-linter/cpp-linter-action/v2/.venv/lib/python3.12/site-packages/cpp_linter/rest_api/github_api.py", line 361, in update_comment
      self.api_request(url=comments_url, method=req_meth, data=payload)
    File "/home/runner/work/_actions/cpp-linter/cpp-linter-action/v2/.venv/lib/python3.12/site-packages/cpp_linter/rest_api/__init__.py", line 124, in api_request
      response.raise_for_status()
    File "/home/runner/work/_actions/cpp-linter/cpp-linter-action/v2/.venv/lib/python3.12/site-packages/requests/models.py", line 1026, in raise_for_status
      raise HTTPError(http_error_msg, response=self)
  requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://api.github.com/repos/Hcolda/QChatServer/issues/45/comments

I doubted that it was my fault, so I checked my permission settings in my repository:

Then I checked them in my organization:

I have no idea about that, so I put an issue for help.

[2bndy5]

This is very odd indeed. I'm unsure where the problem lies. It looks like a generic permissions problem, but you seem to have that adequately setup.

I can tell you that the GITHUB_TOKEN is being used because you would have seen a very different error if that wasn't the case (see python source).

The github status for "API Requests" is currently reporting "operational" (at least in the US).

[2bndy5]

As a work around, you can use

step-summary: true

Instead of thread-comments. The step-summary option requires no special permission and it posts the same comment in the workflow summary page; it works for any PR or push events too.

[quqiOnfree]

As a work around, you can use

step-summary: true
Instead of thread-comments. The step-summary option requires no special permission and it posts the same comment in the workflow summary page; it works for any PR or push events too.

Okay, I have a try.

[2bndy5]

I'm updating the user-agent in our REST API request headers. I doubt it will fix this, but I'm hoping it will prevent our requests from being perceived as spam.

Any python scripts that use the requests python library's default user-agent could easily be considered agents of DDoS attacks.

[quqiOnfree]

What you said really makes sense for me, and I'll do a test.

[2bndy5]

The user-agent change is not instant. It is still in review downstream cpp-linter/cpp-linter#150. I will update this thread when any relevant changes go live (under v2 tag).

[2bndy5]

Ok, user-agent change is now live in v2.16.3 (aka v2). Please let me know if the change helps any.

Sorry this took longer than I thought. We've been hardening our CI security and reviewing our release process.

[quqiOnfree]

Ok, user-agent change is now live in v2.16.3 (aka v2). Please let me know if the change helps any.

Sorry this took longer than I thought. We've been hardening our CI security and reviewing our release process.

The issue is still persisting. Here is the GitHub Workflow for reference.
https://github.com/Hcolda/QChatServer/actions/runs/17762043096/job/50476862592?pr=49

[2bndy5]

I think this occurs because GitHub does not allow the GITHUB_TOKEN to be used in a pull_request event for any PR that comes from a fork.

on:
  pull_request:

The above works when the PR's head branch belongs to the base repo.
It will not work if the PR's head branch comes from a fork of the base repo.

Here I can see that quqiOnfree:master is not a branch belonging to Hcolda/QChatServer.

There's nothing we can do about this. GitHub enforces this restriction for security reasons. A fork could steal sensitive info during CI runtime if the GITHUB_TOKEN is exposed to the fork.

GitHub did introduce the pull_request_target event as a alternative. But the CI workflows run against the PR's base branch in a pull_request_target event. This means the solution is useless when wanting to post a comment about static analysis of the PR's incoming changes.

[2bndy5]

There should be a way to dynamically use step-summary instead of thread-comments when the head branch is from a fork. My guess is to use the github context to determine this scenario.

      - uses: cpp-linter/cpp-linter-action@v2
        id: linter
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          style: 'file'
          tidy-checks: ''
          extra-args: '-std=c++23'
          # only post comments on PR event from origin remote
          thread-comments: ${{ github.event_name == 'pull_request' && startsWith(github.repository, 'Hcolda/') && 'update' }}
          # only use step summary when event is triggered from a fork
          step-summary: ${{ !startsWith(github.repository, 'Hcolda/') }}

There's probably a better way to do this, but this is my quick and dirty hack...

[quqiOnfree]

You're welcome, and thank you for the information and your help. I should have caught that myself... Sorry for taking up your time, and I'll try the step-summary method instead.