Can't edit pull request body when "Allow edits by maintainers" is unchecked

[tranhl]

Hi there, I have a pr here:
Milkdown/milkdown#1945

And I configured my action here:
https://github.com/Milkdown/milkdown/blob/main/.github/workflows/town.yml

And the action runs successfully:
https://github.com/Milkdown/milkdown/actions/runs/15471454112

But I don't see the action update my pr. Is there anything I missed?

Thanks in advance.

Originally posted by @Saul-Mirone in #58

[Saul-Mirone]

Thank you for creating this.
If you need a open pr, here it is: Milkdown/milkdown#1947.

I'll keep it open for one day.

[tranhl]

Thank you for creating this. If you need a open pr, here it is: Milkdown/milkdown#1947.

I'll keep it open for one day.

Thanks! That won't be necessary though as I can investigate with a fork of your repo 😄. Your configuration looks correct and looking through the workflow logs, the action itself is receiving correct inputs. This tells me that the issue is in the action itself.

[tranhl]

@Saul-Mirone I've forked the repo and created a test PR but can't seem to replicate the issue. Now I'm thinking that there could be some repository settings getting the action's GitHub API call to update the PR body.

Would you be able to share with me your branch/ruleset/action configuration to help diagnose this further?

[Saul-Mirone]

Sure, here're some configurations:

[tranhl]

Everything looks alright to me 🤔. I have a feeling another PR check could be overwriting the Git Town action. Would you be able to run it in isolation to see narrow this down?

[Saul-Mirone]

https://github.com/Milkdown/milkdown/actions/runs/15482443938 Here is a manually rerun.

[tranhl]

@Saul-Mirone I've added additional logging to the action in v1.2.1, could you update to this version and re-run again? Hopefully this will give us a better idea of what's going on.

[Saul-Mirone]

Here it is: https://github.com/Milkdown/milkdown/actions/runs/15486074325/job/43600946803
seems nothing logged out.

[Saul-Mirone]

I found out that it's related to this community pr: Milkdown/milkdown#1931

After I closing this pr, the action works.
I think maybe there's something you can do to bypass the pr from forked repo?

Some additional information:
There're two prs from forked repo. One enabled "allow editing by users", the other doesn't. And the enabled one won't affect this workflow.

[tranhl]

I found out that it's related to this community pr: Milkdown/milkdown#1931

After I closing this pr, the action works. I think maybe there's something you can do to bypass the pr from forked repo?

Some additional information: There're two prs from forked repo. One enabled "allow editing by users", the other doesn't. And the enabled one won't affect this workflow.

Thanks for digging into it, this is really helpful! Just so I understand this correctly, does the workflow work with "Allow editing by users" checked or unchecked?

[Saul-Mirone]

It doesn't work with unchecked. And work with checked.

[tranhl]

Thanks for clarifying. I have a feeling that there won't be a workaround for this as unchecking the "Allow edits by maintainers" option revokes write access to actors that don't have write access to the forked repository. I'll do some testing to confirm this and let you know how that goes.

[Saul-Mirone]

@tranhl if there's an option to skip pr created by forked repo, that will also help.

[tranhl]

@Saul-Mirone Apologies for the wait. Having looked into it, we only have two options to solve this particular problem:

1. Create a PAT, store it as a repository secret and pass that into the github-token input of the action, for example:

   name: Git Town
   
   on:
     pull_request:
       branches:
         - '**'
   
   jobs:
     git-town:
       name: Display the branch stack
       runs-on: ubuntu-latest
   
       permissions:
         contents: read
         pull-requests: write
   
       steps:
         - uses: actions/checkout@v4
         - uses: git-town/action@v1
           with:
             github-token: ${{ secrets.GIT_TOWN_GITHUB_TOKEN }}

2. Prompt contributors to always check "Allow edits by maintainers"

Both options have their pros & cons. Creating a PAT introduces a security attack vector onto the repository. This can be mitigated by setting fine-grained permissions and rotating the PAT regularly. The second option poses no security risks but comes down to compliance by contributors to work correctly.

I'll document this in the action's README, I don't think there's much more we can do from the action's end. Thanks so much for reporting this in and helping investigate it, I wouldn't have been able to track it down without your help!

if there's an option to skip pr created by forked repo, that will also help.

I'm not sure I see how an option would help here, as the action already fails silently if there aren't enough permissions?