GITHUB_TOKEN permissions used by this action about dependencies-action

[felladrin]

That's true, it's up to the user. My suggestion was to point the users to this info somewhere in the Readme, because I assume more users will open issues related to this later on.

I think something like this in the Readme would help:

Note that this action requires permissions to read both Pull Requests and Issues from the repository. If you get an error like 'Resource not accessible by integration', please refer to this documentation or this example.

[felladrin]

@gregsdennis, please take it into account. This is some useful info to have on Readme.

In my case, here's how the workflow file ended up:

name: PR Dependency Check

on: [pull_request]

jobs:
  pr-dependency-check:
    runs-on: ubuntu-latest
    name: Check PR Dependency
    permissions:
      pull-requests: read # Reason: To check PRs for dependencies.
      issues: read # Reason: To check issues for dependencies.
    steps:
    - uses: gregsdennis/dependencies-action@main
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

[gregsdennis]

@felladrin I'm happy to make changes, but I'm not sure what this is asking me to do. The post seems more informational than a call to action.

[felladrin]

It's related to the RequestError [HttpError]: Resource not accessible by integration, which can happen if those permissions are not set.

For example, this error can occur if a person creating a PR does not have full permissions to the repository (e.g. they're just a collaborator and not an owner). So when we add the permissions directly into the workflow file, it adds the permission on-the-fly to the GitHub Token.

[gregsdennis]

@felladrin that's good info, but what do I need to do for this? It looks like it's something that's in the user's action.yml, not anything here. This is where I'm confused.