Danger failing on changelog check job

[armcknight]

Description

Due to a 403, e.g.: https://github.com/getsentry/sentry-cocoa/actions/runs/4403587841/jobs/7712145746#step:4:58

Possibly related to danger/danger-js#1031

[philipphofmann]

@armcknight, how often do you see this happening? What can we do to fix it?

[armcknight]

Not sure really. It actually does seem like it's running, because it left a comment on my current PR and keeps editing it. (On that PR, I actually did add a changelog entry so I'm not sure why it keeps warning about that.)

Someone mentioned it could be related to trying to edit a comment it's already left, but again that's working so I'm not sure what's up.

The end of the linked issue mentions token permissions, maybe we need to double check whatever token we provide to it?

[philipphofmann]

maybe we need to double check whatever token we provide to it?

Could you do that, please, @armcknight? Karl has access to the tokens, so you could ping him.

[philipphofmann]

@armcknight, can you please reply to my question above ⬆️ ?

[armcknight]

Done @philipphofmann , sorry I missed this.

[kahest]

For danger, we use the default GITHUB_TOKEN created for workflow runs, with the “Default access (permissive)” scope. Seems like some API usages of danger are not covered by this. The log output is pretty bad though - looks like it manages e.g. to update the changelog comment, but fails on some other thing with a 403.

We have 2 options:

• create a bot and use a PAT with the least permissions needed (might be a lot of trial & error, also might be that it would require permissions we don’t want to give it)
• modify the permissions of GITHUB_TOKEN in the workflow file

We discussed to go with the second option.

[github-actions]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Backlog or Status: In Progress, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[cmanallen]

I doubt this auth issue has persisted for a year without resolution. Feel free to re-open if this was closed incorrectly.