Package manager versions outdated

[MikeMcC399]

Version Sync workflow fails "Resource not accessible by integration"

Issue

The workflow Version Sync, mentioned in CONTRIBUTING.md "that keeps pinned versions up-to-date", is scheduled to run weekly, has been failing since Sep 2024.

Consequently, versions in config.json are months out of date (apart from Yarn 1 Classic where there has been no new version released):

Package Manager	config version	latest version
npm	10.9.1	11.0.0
pnpm	9.14.2	9.15.3
Yarn (classic)	1.22.22	1.22.22
Yarn	4.5.2	4.6.0

Logs

Jan 10, 2025 https://github.com/nodejs/corepack/actions/runs/12700915343/job/35404505886

Error: Resource not accessible by integration

Run gr2m/create-or-update-pull-request-action@77596e3166f328b24613f7082ab30bf2d93079d5
Remote branch "actions/tools-update-config.json" checked out locally.
RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/gr2m/create-or-update-pull-request-action/77596e3166f328b24613f7082ab30bf2d93079d5/dist/index.js:9160:21
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async main (/home/runner/work/_actions/gr2m/create-or-update-pull-request-action/77596e3166f328b24613f7082ab30bf2d93079d5/dist/index.js:792:9) {
  status: 403,
  response: {
    url: 'https://api.github.com/repos/nodejs/corepack/pulls',
    status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      connection: 'close',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Fri, 10 Jan 2025 00:32:07 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'github.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-accepted-github-permissions': 'pull_requests=write',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3; format=json',
      'x-github-request-id': '68A9:3E2E99:172181E:2E21CFC:67806A87',
      'x-ratelimit-limit': '15000',
      'x-ratelimit-remaining': '14996',
      'x-ratelimit-reset': '1736472688',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '4',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Resource not accessible by integration',
      documentation_url: 'https://docs.github.com/rest/pulls/pulls#create-a-pull-request',
      status: '403'
    }
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/nodejs/corepack/pulls',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'octokit-core.js/3.5.1 Node.js/20.18.0 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"title":"feat: update package manager versions","body":"This is an automated update of package manager versions","head":"actions/tools-update-config.json","base":"main"}',
    request: { hook: [Function: bound bound register] }
  }
}
Error: Resource not accessible by integration

[styfle]

Looks like @aduh95 might have permission to fix this.

Looks like the repo settings need to be changed per gr2m/create-or-update-pull-request-action#557 (comment)

[MikeMcC399]

@styfle

Looks like @aduh95 might have permission to fix this.

Looks like the repo settings need to be changed per gr2m/create-or-update-pull-request-action#557 (comment)

• chore: fix sync.yml permissions #554 also mentions permissions

[MikeMcC399]

Possibly @arcanis or @aduh95 (or whoever is currently organizationally responsible) should check their settings for Notifications for workflow runs. If enabled, GitHub would send a failure notification. I don't really understand otherwise how the workflow could be failing for the last 4 months without any apparent attempt to fix it.

[aduh95]

Maybe it has changed since last time I tried enable it, but I find GitHub failure notification not worth the noise, so I'm not enabling that, no thank you.

Looks like the repo settings need to be changed per gr2m/create-or-update-pull-request-action#557 (comment)

No those are disabled at the org level:

The options we have are:

• stop using https://github.com/gr2m/create-or-update-pull-request-action, we could simply push the changes and create the PR using API calls.
• Request a bot token with the correct permission to keep using gr2m action.
• Do nothing/keep updating the config file manually.

It's a volunteer based project, so until someone commits their time on that issue, the latter will apply. Worth noting that the internal config file is only used when COREPACK_DEFAULT_TO_LATEST is set to 0 in the env, so being behind there won't affect most Corepack users – but we should still fix it, at least because it allows us to test Corepack with latest versions of supported package managers.

[MikeMcC399]

@aduh95

I am able to run the workflow in a fork by adding pull_requests: write permissions. It looks like this was all that was missing.

    permissions:
      contents: write
      pull-requests: write

• It then created a PR feat: update package manager versions MikeMcC399/corepack#2 for me

[MikeMcC399]

@aduh95

• I went ahead and submitted chore: add pull_requests: write permissions to sync workflow #593. If you, or one of the other maintainers, would like to approve the PR workflow running, we should be able to close this issue. I haven't submitted to this repo previously, so GitHub doesn't run the workflows unless approved.

[MikeMcC399]

• PR chore: add pull_requests: write permissions to sync workflow #593 is now merged
• This gives Version Sync (sync.yml) privileges to create a PR
• Now either a maintainer with write privileges to the repo needs to run Version Sync manually OR
• if there is no manual intervention it will next run according to

  # Run once a week at 00:05 UTC on Friday.
  - cron: 5 0 * * 5

  which would be Friday, Jan 17, 2025
• Running the workflow should generate a PR

[MikeMcC399]

@aduh95

Would you like to manually trigger the workflow Version Sync now or do you prefer to wait for cron to kick in on Friday?

[aduh95]

I've ran it manually for you: https://github.com/nodejs/corepack/actions/runs/12765046315/job/35578428609

Looks it's working great, thanks

[MikeMcC399]

@aduh95

I've ran it manually for you: https://github.com/nodejs/corepack/actions/runs/12765046315/job/35578428609

Looks it's working great, thanks

It's great to see that the workflow is successful.

• This issue is however not resolved until feat: update package manager versions #595 is merged, otherwise the changes are not pushed into production.
  • ... and I guess that a new release of corepack needs to be done chore(main): release 0.31.0 #596
    • ... and then that release would need to be bundled into releases of Node.js in order to reach regular users.