Run docker/metadata-action against private repos #136

Open
opened 2023-04-22 22:11:31 +00:00 by harryzcy · 12 comments
harryzcy commented 2023-04-22 22:11:31 +00:00 (Migrated from gitea.com)

I can run docker/metadata-action with public repos. But for private repos, I get ::error::The target couldn't be found. error. Is there a way to pass a token so it can get the commit?

I can run `docker/metadata-action` with public repos. But for private repos, I get `::error::The target couldn't be found.` error. Is there a way to pass a token so it can get the commit?
Zettat123 commented 2023-04-23 01:40:56 +00:00 (Migrated from gitea.com)

I can't reproduce this bug. Which version of act_runner are you using?

I can't reproduce this bug. Which version of `act_runner` are you using?
harryzcy commented 2023-04-26 17:00:33 +00:00 (Migrated from gitea.com)

act_runner version:

$ git describe
v0.0.1-64-g293926f
$ git rev-parse --short HEAD
293926f

Gitea version: v1.19.1
Trigger is pull_request

act_runner version: ```shell $ git describe v0.0.1-64-g293926f $ git rev-parse --short HEAD 293926f ``` Gitea version: v1.19.1 Trigger is pull_request
sillyguodong commented 2023-04-27 02:10:34 +00:00 (Migrated from gitea.com)

Hi, can you paste your workflow here.
Or you can try to add tags input in your step of docker/meta-data-action like this:

tags: |
  type=ref,event=pr
Hi, can you paste your workflow here. Or you can try to add `tags input` in your step of `docker/meta-data-action` like this: ```yaml tags: | type=ref,event=pr ```
wolfogre commented 2023-04-27 02:12:36 +00:00 (Migrated from gitea.com)

Could you please provide more details such as workflow files and logs?

Could you please provide more details such as workflow files and logs?
harryzcy commented 2023-05-01 07:16:25 +00:00 (Migrated from gitea.com)

I'll try to create a reproduced sample in the coming days

I'll try to create a reproduced sample in the coming days
zcube commented 2023-05-08 18:13:02 +00:00 (Migrated from gitea.com)

I have reproduced this issue. The error occurs when making the following API call:

https://{{gitea server}}//api/v1/repos/{{org}}/{{repo}}

2023/05/08 08:44:01 [645837c1] router: completed GET //api/v1/repos/{{org}}/{{repo}}  for 172.19.0.252:44762, 404 Not Found in 2.7ms @ v1/api.go:135(v1.repoAssignment)

The related code is as follows:

https://github.com/docker/metadata-action/blob/c4ee3adeed93b1fa6a762f209fb01608c1a22f1e/src/main.ts#L24
https://github.com/docker/actions-toolkit/blob/31e5d12fd9af697b89eb1befb3c6f5347563e1eb/src/github.ts#L37
https://github.com/actions/toolkit/blob/457303960f03375db6f033e214b9f90d79c3fe5c/packages/github/src/internal/utils.ts#L15

The API can be found at https://gitea.com/api/swagger#/repository/repoGet.

It appears that the actions account does not have permission for this API.

Therefore, I have modified the code to operate based on the repository information included in the context without making the corresponding request.

https://gitea.com/zcube/metadata-action/commit/5b903a5f81f488ec30deb6bd811291afc7482e11

To use the gitea branch, use the following snippet:

- name: Docker meta
  id: meta
  uses: https://gitea.com/zcube/metadata-action@gitea
I have reproduced this issue. The error occurs when making the following API call: https://{{gitea server}}//api/v1/repos/{{org}}/{{repo}} ``` 2023/05/08 08:44:01 [645837c1] router: completed GET //api/v1/repos/{{org}}/{{repo}} for 172.19.0.252:44762, 404 Not Found in 2.7ms @ v1/api.go:135(v1.repoAssignment) ``` The related code is as follows: https://github.com/docker/metadata-action/blob/c4ee3adeed93b1fa6a762f209fb01608c1a22f1e/src/main.ts#L24 https://github.com/docker/actions-toolkit/blob/31e5d12fd9af697b89eb1befb3c6f5347563e1eb/src/github.ts#L37 https://github.com/actions/toolkit/blob/457303960f03375db6f033e214b9f90d79c3fe5c/packages/github/src/internal/utils.ts#L15 The API can be found at https://gitea.com/api/swagger#/repository/repoGet. It appears that the actions account does not have permission for this API. Therefore, I have modified the code to operate based on the repository information included in the context without making the corresponding request. https://gitea.com/zcube/metadata-action/commit/5b903a5f81f488ec30deb6bd811291afc7482e11 To use the gitea branch, use the following snippet: ``` - name: Docker meta id: meta uses: https://gitea.com/zcube/metadata-action@gitea ```
wolfogre commented 2023-05-09 02:04:01 +00:00 (Migrated from gitea.com)

It think the problem could be:

  • metadata-action doesn't use secrets.GITHUB_TOKEN to request API.
  • (Unlikely) Or secrets.GITHUB_TOKEN doesn't have the permission for this API.
It think the problem could be: - metadata-action doesn't use `secrets.GITHUB_TOKEN` to request API. - (Unlikely) Or `secrets.GITHUB_TOKEN` doesn't have the permission for this API.
zcube commented 2023-05-09 06:05:53 +00:00 (Migrated from gitea.com)

Even when tokens are explicitly specified as shown below, errors can still occur:

- name: Docker meta
  id: meta
  uses: https://github.com/docker/metadata-action@v4
  with:
    images: ${{ env.REGISTRY }}/${{ steps.repository.outputs.lowercase }}
    github-token: ${{ secrets.GITHUB_TOKEN }}

In addition, the github token is set to read the environment variable "GITHUB_TOKEN":

https://github.com/docker/metadata-action/blob/c4ee3adeed93b1fa6a762f209fb01608c1a22f1e/src/main.ts#L22

const toolkit = new Toolkit({githubToken: inputs.githubToken});

https://github.com/docker/metadata-action/blob/c4ee3adeed93b1fa6a762f209fb01608c1a22f1e/src/context.ts#L29

githubToken: core.getInput('github-token')

https://github.com/actions/toolkit/blob/457303960f03375db6f033e214b9f90d79c3fe5c/packages/core/src/core.ts#L126

export function getInput(name: string, options?: InputOptions): string {

Therefore, I think it is likely to be an authentication issue.

Even when tokens are explicitly specified as shown below, errors can still occur: ```yaml - name: Docker meta id: meta uses: https://github.com/docker/metadata-action@v4 with: images: ${{ env.REGISTRY }}/${{ steps.repository.outputs.lowercase }} github-token: ${{ secrets.GITHUB_TOKEN }} ``` In addition, the github token is set to read the environment variable "GITHUB_TOKEN": https://github.com/docker/metadata-action/blob/c4ee3adeed93b1fa6a762f209fb01608c1a22f1e/src/main.ts#L22 ``` const toolkit = new Toolkit({githubToken: inputs.githubToken}); ``` https://github.com/docker/metadata-action/blob/c4ee3adeed93b1fa6a762f209fb01608c1a22f1e/src/context.ts#L29 ``` githubToken: core.getInput('github-token') ``` https://github.com/actions/toolkit/blob/457303960f03375db6f033e214b9f90d79c3fe5c/packages/core/src/core.ts#L126 ``` export function getInput(name: string, options?: InputOptions): string { ``` Therefore, I think it is likely to be an authentication issue.
harryzcy commented 2023-05-17 13:28:06 +00:00 (Migrated from gitea.com)

In my production instance, I can see from the log that Actions made a call to //api/v1/repos/user/repo/ (note the double slash) that Gitea returned 404 when the repo is private, and returned the content when it's public. The 404 logs is the following:

2023/05/17 13:49:19 [6464db5f] router: completed GET //api/v1/repos/harryzcy/repo for 10.42.0.228:52428, 404 Not Found in 10.7ms @ v1/api.go:135(v1.repoAssignment)

However, when I set up an test instance from scratch, I can't reproduce this. The Action send the request to /api/v1/repos/user/repo/ (single slash here) and returns 200, even with private repos. I'm not sure why this is happening. The successful log is the following:

2023/05/17 13:44:24 [6464da38] router: completed GET /api/v1/repos/harryzcy/test-workflows for 129.213.125.156:0, 200 OK in 9.2ms @ repo/repo.go:512(repo.Get)

Both of them are running v1.19.3.

In my production instance, I can see from the log that Actions made a call to `//api/v1/repos/user/repo/` (note the double slash) that Gitea returned 404 when the repo is private, and returned the content when it's public. The 404 logs is the following: ``` 2023/05/17 13:49:19 [6464db5f] router: completed GET //api/v1/repos/harryzcy/repo for 10.42.0.228:52428, 404 Not Found in 10.7ms @ v1/api.go:135(v1.repoAssignment) ``` However, when I set up an test instance from scratch, I can't reproduce this. The Action send the request to `/api/v1/repos/user/repo/` (single slash here) and returns 200, even with private repos. I'm not sure why this is happening. The successful log is the following: ``` 2023/05/17 13:44:24 [6464da38] router: completed GET /api/v1/repos/harryzcy/test-workflows for 129.213.125.156:0, 200 OK in 9.2ms @ repo/repo.go:512(repo.Get) ``` Both of them are running v1.19.3.
lunny commented 2023-05-18 00:38:06 +00:00 (Migrated from gitea.com)

In my production instance, I can see from the log that Actions made a call to //api/v1/repos/user/repo/ (note the double slash) that Gitea returned 404 when the repo is private, and returned the content when it's public. The 404 logs is the following:

2023/05/17 13:49:19 [6464db5f] router: completed GET //api/v1/repos/harryzcy/repo for 10.42.0.228:52428, 404 Not Found in 10.7ms @ v1/api.go:135(v1.repoAssignment)

However, when I set up an test instance from scratch, I can't reproduce this. The Action send the request to /api/v1/repos/user/repo/ (single slash here) and returns 200, even with private repos. I'm not sure why this is happening. The successful log is the following:

2023/05/17 13:44:24 [6464da38] router: completed GET /api/v1/repos/harryzcy/test-workflows for 129.213.125.156:0, 200 OK in 9.2ms @ repo/repo.go:512(repo.Get)

Both of them are running v1.19.3.

Could you compare your both ROOT_URL? I think maybe one has a slash suffix but another has not.

> In my production instance, I can see from the log that Actions made a call to `//api/v1/repos/user/repo/` (note the double slash) that Gitea returned 404 when the repo is private, and returned the content when it's public. The 404 logs is the following: > > ``` > 2023/05/17 13:49:19 [6464db5f] router: completed GET //api/v1/repos/harryzcy/repo for 10.42.0.228:52428, 404 Not Found in 10.7ms @ v1/api.go:135(v1.repoAssignment) > ``` > > However, when I set up an test instance from scratch, I can't reproduce this. The Action send the request to `/api/v1/repos/user/repo/` (single slash here) and returns 200, even with private repos. I'm not sure why this is happening. The successful log is the following: > > ``` > 2023/05/17 13:44:24 [6464da38] router: completed GET /api/v1/repos/harryzcy/test-workflows for 129.213.125.156:0, 200 OK in 9.2ms @ repo/repo.go:512(repo.Get) > ``` > > Both of them are running v1.19.3. Could you compare your both `ROOT_URL`? I think maybe one has a slash suffix but another has not.
harryzcy commented 2023-05-18 11:58:06 +00:00 (Migrated from gitea.com)

Could you compare your both ROOT_URL? I think maybe one has a slash suffix but another has not.

No, both of them have the slash suffix.

> Could you compare your both `ROOT_URL`? I think maybe one has a slash suffix but another has not. No, both of them have the slash suffix.
zcube commented 2023-05-19 02:33:34 +00:00 (Migrated from gitea.com)

Open the .runner file and remove the trailing slash of address and it will work.

http://localhost:8000/ -> http://localhost:8000

This is different from what is described in README.md, so I think it should be modified to remove it from within act_runner.

https://gitea.com/gitea/act_runner/src/commit/84386c1b167d93323728f1f9e5ebda86f2a5d744/README.md#L49

I think the following patch is needed

https://gitea.com/gitea/act_runner/src/commit/84386c1b167d93323728f1f9e5ebda86f2a5d744/internal/app/run/runner.go#L187

GitHubInstance:        r.client.Address(),
->
GitHubInstance:        strings.TrimSuffix(r.client.Address(), "/"),

Every git operation (fork, migration) on gitea.com gives me a 500 error.

It's probably blocked. :(

So I can't make a PR.

Open the .runner file and remove the trailing slash of address and it will work. ``` http://localhost:8000/ -> http://localhost:8000 ``` This is different from what is described in README.md, so I think it should be modified to remove it from within act_runner. https://gitea.com/gitea/act_runner/src/commit/84386c1b167d93323728f1f9e5ebda86f2a5d744/README.md#L49 I think the following patch is needed https://gitea.com/gitea/act_runner/src/commit/84386c1b167d93323728f1f9e5ebda86f2a5d744/internal/app/run/runner.go#L187 ``` GitHubInstance: r.client.Address(), -> GitHubInstance: strings.TrimSuffix(r.client.Address(), "/"), ``` Every git operation (fork, migration) on gitea.com gives me a 500 error. It's probably blocked. :( So I can't make a PR.
Sign in to join this conversation.