Gruntwork pipelines bootstraping fails with 403

[jeffreymlewis]

Hello,

I'm trying to use the bootstrap.yml Action to setup GW pipelines in an existing repo. The Create Pull Request job is failing with the following error.

/usr/bin/git symbolic-ref HEAD --short
  main
  Working base is branch 'main'
  /usr/bin/git remote prune origin
  remote: Write access to repository not granted.
  fatal: unable to access 'https://github.com/my-org/infrastructure-live/': The requested URL returned error: 403
  Error: The process '/usr/bin/git' failed with exit code 128

This job is using the INFRA_LIVE_ACCESS_TOKEN token, so I assumed there is a problem with that token. It is setup as a fine-grained token as described on your machine users page. The GH account owning this token is a collaborator on this repo with WRITE access. I tried granting all possible "fine grained" repo permissions to this token, but that didn't work. I also confirmed that the repo (and org) have Workflow permissions set to "Read and write permissions" with the "Allow GH Actions to create and apporve PRs" checkbox selected.

But anyway, it seems to be failing to run 'remote prune origin' which is strange. Any ideas. Like I said, this is an EXISTING infrastructure-live repo that I'm trying to bootstrap using the bootstrap.yml from the gruntwork-infra-live-standalone-template repo as shown above.

Thanks in advance for your help!

---

Tracked in ticket #110605

[jeffreymlewis]

Should have mentioned it's the Create Pull Request job that's failing. Updated description.

[arsci]

Hi @jeffreymlewis, the first thing that I would check is the CI user permissions, and the second thing I would check is the CI user PAT configuration.

I see that you mentioned that the GitHub account owning the token is a collaborator with write access, but I'd like to double check how you configured the write access. If you go into your GitHub organization page, go to the People tab, then search and select your CI user account. Once at the access page for your user, can you confirm that your user is listed as having Write access to both your infrastructure-live and infrastructure-pipelines repositories?

If that looks good, the next thing to confirm is the organization scope of the GitHub Fine-Grained token. If you log in as your CI user, navigate to the Fine Grained token page in the developer settings menu, can you confirm that the Organization is set correctly for the INFRA_LIVE_ACCESS_TOKEN? You should see text that says something like Access on the organization below the description in the token settings page. It's important that your Organization is specifically selected here, and I call this out because by default fine-grained tokens are disabled for GitHub organizations and if that was the case, the org would not have appeared. This setting is very easy to overlook when creating the PATs (I've personally done it numerous times in testing!)

Let me know if those all look good, and we can try some other steps to debug if needed!

[jeffreymlewis]

Thanks @arsci I figured it out. We didn't have fine-grained tokens enabled at the org level. Once this was done, everything worked as expected.