GitHub actions not identifying environment secret tokens - github-actions

I recently created two workflows that deploy a preview when a push is made to a non-release branch (incl main) and deploys a production build when pushed to the release branch. However the preview workflow is failing with the error:
Error: No existing credentials found. Please run vercel login or pass "--token"
On the line:
vercel pull --yes --environment=preview --token=
I've setup the tokens in environment secrets of the repository, and below is the workflow file:
name: Preview Deployment
env:
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
VERCEL_TOKEN: ${{secrets.VERCEL_TOKEN }}
on:
push:
branches-ignore:
- release
jobs:
Deploy-Preview:
runs-on: ubuntu-latest
steps:
- name: "Echo values"
run: |
echo $VERCEL_PROJECT_ID
echo $VERCEL_TOKEN
- uses: actions/checkout#v2
- name: Install Vercel CLI
run: npm install --global vercel#latest
- name: Pull Vercel Environment Information
run: vercel pull --yes --environment=preview --token=${{ secrets.VERCEL_TOKEN }}
- name: Build Project Artifacts
run: vercel build --token=${{ secrets.VERCEL_TOKEN }}
- name: Deploy Project Artifacts to Vercel
run: vercel deploy --prebuilt --token=${{ secrets.VERCEL_TOKEN }}
The echo isn't logging anything, not even ***(Although this isn't any important step, it was just a way to possibly debug the issue). I've followed this article from vercel to create the workflow. I'm pretty sure that the tokens are set up correctly, again at the same time, I'm unable to pinpoint the cause of the error. How do I fix this? TIA.

Related

Deploy Gatsby website with github actions

I'm new with gatsby and github actions. I'm trying to publish the website on github.
Here's my publish.yml file
on:
push:
branches:
- master
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout#v1
- uses: actions/setup-node#v3
with:
node-version: 18
- uses: enriikke/gatsby-gh-pages-action#v2
with:
access-token: ${{ secrets.**** }}
deploy-branch: gh-pages
gatsby-args: --prefix-paths
But I have this error on github:
/usr/bin/git push -f https://***#github.com/lentsius-bark/krystof-klestil.git master:gh-pages
fatal: could not read Password for 'https://***#github.com': No such device or address
Error: The process '/usr/bin/git' failed with exit code 128
The error looks like there is some issue with the access token that git push is trying to use.
Try these methods to resolve the issue.
Make sure that the access token you're using is valid and has the appropriate permissions to push to the gh-pages branch. You can create a new personal access token in your GitHub account settings if needed.
In your workflow file, change ${{ secrets.**** }} to ${{ secrets.ACCESS_TOKEN }} (replace ACCESS_TOKEN with the name of your actual secret). This will ensure that the access token is correctly substituted in the enriikke/gatsby-gh-pages-action#v2 step.

Github Actions Reusable workflows yarn cache not found

I am new to writing GH Actions. I am working on a task to remove common workflows and use the reusable workflow feature available. I am now able to get my workflows to run sequentially which is great. However, the 2nd workflow is resulting in an unexpected error message seemingly related to the yarn dependency workflow not saving to the cache as I would have expected it:
Run yarn lint
... snip
myPackage: /bin/sh: 1: concurrently: not found
Could you take a look at see if this looks ok? For now, my goal is to have a workflow for pull-request which calls yarn and lint as the resuable features:
name: pull-request
on:
pull_request:
branches:
- main
jobs:
yarn:
uses: ./.github/workflows/yarn.yml
validate_lint:
needs: yarn
uses: ./.github/workflows/validate_lint.yml
with:
name: Yarn
on:
workflow_call:
jobs:
yarn_and_deps:
name: Run Lint
runs-on: ubuntu-latest
steps:
- name: Checkout Git repository
uses: actions/checkout#v3
- name: Enable node
uses: actions/setup-node#v3
with:
node-version: 16
- name: Get yarn cache directory path
id: yarn-cache-dir-path
run: echo "::set-output name=dir::$(yarn cache dir)"
- uses: actions/cache#v3
id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
with:
path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
restore-keys: |
${{ runner.os }}-yarn-
- name: Install dependencies
run: yarn install --frozen-lockfile && yarn bootstrap
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
and
name: Validate Lint
on:
workflow_call:
jobs:
run_lint:
name: Run Lint
runs-on: ubuntu-latest
- name: Enable node
uses: actions/setup-node#v3
with:
node-version: 16
cache: 'yarn' # <<--- THIS CACHE IS NOT FOUND 🤷🏻‍♂️
# NOTE: if I add in all the "yarn cache/install" commands from above workflow, this passes.
steps:
- name: Validate Lint
run: yarn lint
The error happens here in the Validate Lint job because it appears that the cache is not found. I made the yarn job to avoid re-creating the wheel for each job.
What is wrong with my expectations on the cache v how it actually works? Having to Install dependencies step each job feels like overkill.
Turns out each workflow is its own docker container. Therefore, if I run yarn in workflow 1's container, workflow 2 has no knowledge/access to the cache.
The closest thing appears to be an upload/download "sharing of data", but this has it's own drawbacks - such as downloading a node_modules folder can be slower than just installing the dependencies.
Unfortunately, the solution seems to be that there is repetition of code when each workflow has a dependency to the output of prior item.

How to get all the changes of a Pull Request when triggering on pull_request_review?

I currently have a GitHub Action that triggers on:
pull_request_review:
types: [submitted]
I then want to run a command, which expects the contents of changes of the Pull Request.
Previously, I was using
on:
push
and I had no issues with the contents of the files being available in the Action context.
However, my command is failing now, and I think it's because the context only includes the commit that the action was triggered on (no file changes.)
Previously I was running this action on push and that was always successful, with the file changes being available in the context.
I'm using:
steps:
- uses: actions/checkout#v2
(https://github.com/actions/checkout)
Is it possible to use this to have all the file changes on the Pull Request within the Action context?
Any help on this would be appreciated!
You can do that by using an open source Action available on marketplace:
jobs:
build:
runs-on: ubuntu-latest # windows-latest | macos-latest
name: Test changed-files
steps:
- uses: actions/checkout#v2
with:
fetch-depth: 0 # OR "2" -> To retrieve the preceding commit.
- name: Get changed files
id: changed-files
uses: tj-actions/changed-files#v14.6
- name: List all changed files
run: |
for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
echo "$file was changed"
done
The solution above uses git checkout and git diff to get files changed by PR. Alternatively if you really need just information about paths changed and you don't really need files themselves (no checkout) - you can do it without checkout using gh CLI:
gh pr view XXX --json files -q '.files[].path'
You can run it like this:
jobs:
comment:
runs-on: ubuntu-latest
steps:
- run: gh pr view XXX --json files -q '.files[].path'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Github action increment version on push to main

I would like to use a pure solution in a GitHub action to increment a version of the package. I don't want to use any existing actions from the GitHub marketplace such as "gh-action-bump-version
". I have this workflow, which will increase the version and create a tag.
name: Version Increment
on:
push:
branches:
- main
tags-ignore:
- v*
jobs:
version:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout#v2
with:
token: ${{ secrets.ACCESS_TOKEN }}
- run: git config user.email "$GITHUB_ACTOR#users.noreply.github.com"
- run: git config user.name "$GITHUB_ACTOR"
- run: npm version minor -m "v%s"
- run: VERSION=$(node -p "require('./package.json').version")
- run: git tag ${VERSION}
- run: git push origin --tags
- run: git push origin --follow-tags
It works, but it also cause a circular runs of the actions because of the last row. I know that I can use a custom message like "[RELEASE]" and put there a "if" condition and skip these commits. But my question is, is there any better solution to skip these commits from this action and do not use the "if" condition? Because the "tags-ignore" obviously doesn't work.
So I found several solutions. The first is that you can put "[skip actions]" to your commit message and that commit will skip any github action that should run within the commit. The second one is to use an address of the repository with access token.
This works pretty well for me:
name: Version Increment
on:
push:
branches:
- main
jobs:
version:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout#v2
- run: git config user.email "$GITHUB_ACTOR#users.noreply.github.com"
- run: git config user.name "$GITHUB_ACTOR"
- run: npm version minor -m "v%s"
- run: VERSION=$(node -p "require('./package.json').version")
- run: git tag ${VERSION}
- run: git push "https://$GITHUB_ACTOR:${{ secrets.ACCESS_TOKEN }}#github.com/$GITHUB_REPOSITORY.git" --follow-tags
- run: git push "https://$GITHUB_ACTOR:${{ secrets.ACCESS_TOKEN }}#github.com/$GITHUB_REPOSITORY.git" --tags
Try using the built in GITHUB_TOKEN instead of your custom ACCESS_TOKEN. That should prevent the workflow from triggering another workflow.
From the docs (https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow):
When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs. For example, if a workflow run pushes code using the repository's GITHUB_TOKEN, a new workflow will not run even when the repository contains a workflow configured to run when push events occur.

Can't push to protected branch in GitHub Action

I have a GitHub action that I have created in order to create a new version and publish it for our JS repo. It looks similar to this
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout#v2
- uses: actions/setup-node#v1
with:
node-version: 12.18.3
registry-url: https://npm.pkg.github.com/
scope: '<redacted>'
- name: Install Dependencies
run: npm ci
- name: Build
run: npm run build
- name: Bump Version & Push
run: |
git config --local user.email "<redacted>"
git config --local user.name "<redacted>"
npm version patch
git push https://${{ secrets.KEY }}#github.com/<redacted> HEAD:master --follow-tags
The KEY that I am using is a person access token I created from my account. I have set the repo so that I have push access to the master branch. When I try the push command from my machine with the access token it works without an issue. However every time I see this in the GitHub Action
remote: error: GH006: Protected branch update failed for refs/heads/master.
remote: error: You're not authorized to push to this branch. Visit https://docs.github.com/articles/about-protected-branches/ for more information.
I have been racking my brain trying to figure this out and I'm out to ideas. If I remove the branch protection this action works fine.
I think this is because of how authentication is persisted by actions/checkout. It's stored in an extraheader config option which takes precedence over the credentials you are setting manually.
Try not persisting the auth:
- uses: actions/checkout#v2
with:
persist-credentials: false
Or alternatively:
- uses: actions/checkout#v2
with:
token: ${{ secrets.KEY }}
I know this because I've had my own issue with overriding this config option in the past.