Github Checkout action failing to find forked repository

[Siddharth-Ashri]

There seems to be an issue where the checkout action fails to find the forked repository. I have used the pull_request_target action and provided the action with the github.token as well. The purpose of the checking out the forked repository is to lint the files after the pull_request is created. So no sensitive changes are being made. Here is what the action looks like

name: PHP Code Linter
on: 
  pull_request_target:
     types: [assigned, opened, synchronize, reopened, edited]

jobs: 
  lint-php-code:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        php-versions: ['8.0']
    steps:
    - uses: actions/checkout@v2
      with:
        fetch-depth: 0
        ref: ${{github.event.pull_request.head.ref}}
        repository: ${{github.event.pull_request.head.repo.full_name}}
        token: ${{ github.token }}

[... linting code]

Here is a sample log from one the failed checks

[elektronik2k5]

This happens to me too in a private repo. Here's the log:

##[debug]Evaluating condition for step: 'Checkout'
##[debug]Evaluating: success()
##[debug]Evaluating success:
##[debug]=> true
##[debug]Result: true
##[debug]Starting: Checkout
##[debug]Register post job cleanup for action: actions/checkout@v2.3.4
##[debug]Loading inputs
##[debug]Evaluating: secrets.GITHUB_TOKEN
##[debug]Evaluating Index:
##[debug]..Evaluating secrets:
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'GITHUB_TOKEN'
##[debug]=> '***'
##[debug]Result: '***'
##[debug]Evaluating: github.repository
##[debug]Evaluating Index:
##[debug]..Evaluating github:
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'repository'
##[debug]=> 'REDACTED_ORG/REDACTED_PRIVATE_REPO_NAME'
##[debug]Result: 'REDACTED_ORG/REDACTED_PRIVATE_REPO_NAME'
##[debug]Loading env
Run actions/checkout@v2.3.4
  with:
    token: ***
    repository: REDACTED_ORG/REDACTED_PRIVATE_REPO_NAME
    ssh-strict: true
    persist-credentials: true
    clean: true
    fetch-depth: 1
    lfs: false
    submodules: false
::save-state name=isPost,::true
##[debug]Save intra-action state isPost = true
##[debug]GITHUB_WORKSPACE = '/home/runner/work/operator_dashboard_ui/operator_dashboard_ui'
##[debug]qualified repository = 'REDACTED_ORG/REDACTED_PRIVATE_REPO_NAME'
##[debug]ref = 'refs/pull/784/merge'
##[debug]commit = 'REDACTED_COMMIT_HASH'
##[debug]clean = true
##[debug]fetch depth = 1
##[debug]lfs = false
##[debug]submodules = false
##[debug]recursive submodules = false
::add-matcher::/home/runner/work/_actions/actions/checkout/v2.3.4/dist/problem-matcher.json
##[debug]Added matchers: 'checkout-git'. Problem matchers scan action output for known warning or error strings and report these inline.
Syncing repository: REDACTED_ORG/REDACTED_PRIVATE_REPO_NAME
::group::Getting Git version info
Getting Git version info
  Working directory is '/home/runner/work/operator_dashboard_ui/operator_dashboard_ui'
  ##[debug]Getting git version
  /usr/bin/git version
  git version 2.32.0
  ##[debug]Set git useragent to: git/2.32.0 (github-actions-checkout)
  ::endgroup::
Deleting the contents of '/home/runner/work/operator_dashboard_ui/operator_dashboard_ui'
::save-state name=repositoryPath,::/home/runner/work/operator_dashboard_ui/operator_dashboard_ui
##[debug]Save intra-action state repositoryPath = /home/runner/work/operator_dashboard_ui/operator_dashboard_ui
::group::Initializing the repository
Initializing the repository
  /usr/bin/git init /home/runner/work/operator_dashboard_ui/operator_dashboard_ui
  hint: Using 'master' as the name for the initial branch. This default branch name
  hint: is subject to change. To configure the initial branch name to use in all
  hint: of your new repositories, which will suppress this warning, call:
  hint: 
  hint: 	git config --global init.defaultBranch <name>
  hint: 
  hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
  hint: 'development'. The just-created branch can be renamed via this command:
  hint: 
  hint: 	git branch -m <name>
  Initialized empty Git repository in /home/runner/work/operator_dashboard_ui/operator_dashboard_ui/.git/
  /usr/bin/git remote add origin https://github.com/REDACTED_ORG/REDACTED_PRIVATE_REPO_NAME
  ::endgroup::
::group::Disabling automatic garbage collection
Disabling automatic garbage collection
  /usr/bin/git config --local gc.auto 0
  ::endgroup::
::add-mask::***
::group::Setting up auth
Setting up auth
  /usr/bin/git config --local --name-only --get-regexp core\.sshCommand
  /usr/bin/git submodule foreach --recursive git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :
  /usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
  /usr/bin/git submodule foreach --recursive git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :
  /usr/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ***
  ::endgroup::
::group::Fetching the repository
Fetching the repository
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +REDACTED_COMMIT_HASH:refs/remotes/pull/784/merge
  remote: Repository not found.
  Error: fatal: repository 'https://github.com/REDACTED_ORG/REDACTED_PRIVATE_REPO_NAME/' not found
  The process '/usr/bin/git' failed with exit code 128
  Waiting 16 seconds before trying again
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +REDACTED_COMMIT_HASH:refs/remotes/pull/784/merge
  remote: Repository not found.
  Error: fatal: repository 'https://github.com/REDACTED_ORG/REDACTED_PRIVATE_REPO_NAME/' not found
  The process '/usr/bin/git' failed with exit code 128
  Waiting 15 seconds before trying again
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +REDACTED_COMMIT_HASH:refs/remotes/pull/784/merge
  remote: Repository not found.
  Error: fatal: repository 'https://github.com/REDACTED_ORG/REDACTED_PRIVATE_REPO_NAME/' not found
  ::remove-matcher owner=checkout-git,::
  ##[debug]Removed matchers: 'checkout-git'
  Error: The process '/usr/bin/git' failed with exit code 128
  ##[debug]Node Action run completed with exit code 1
  ##[debug]Finishing: Checkout

[vishnu-narayanan]

Actions v3 with ref and repository specified like this seems to work.

  - uses: actions/checkout@v3
     with:
       ref: ${{ github.event.pull_request.head.ref }}
       repository: ${{ github.event.pull_request.head.repo.full_name }}
       

ref: chatwoot/chatwoot#4587

[Siddharth-Ashri]

Actions v3 with ref and repository specified like this seems to work.

  - uses: actions/checkout@v3
     with:
       ref: ${{ github.event.pull_request.head.ref }}
       repository: ${{ github.event.pull_request.head.repo.full_name }}
       

ref: chatwoot/chatwoot#4587

Hi I tried that, but it doesn't seem to work for private repos

[schmidtw]

In the enterprise space this is fairly annoying for developers who fork, then do PRs back. If the credentials are made to work is made better that would be nice. Needing an extra token simply to clone the forked repo with a patch for the PR means one more secret to leak & expire. Is there a way the github.TOKEN can be able to clone the fork?

Or is there a way to do this painlessly that maybe isn't obvious?