Add a requirement for git repo Settings's Workflow Permissions to the document

[hcg1023]

I felt that adding a request for Workflow Permissions for Git Settings at the beginning of the document would have saved me a lot of trouble. It was my first time using Github Actions and Changesets and the constant error reporting was very annoying, The default permissions are read-only and do not allow the creation and approval of pull requests

However, you need to write and create permission to approve pull requests

[smiley-uriux]

Might also be useful to mention the specific permissions needed for those that can't or do not wish to grant full workflow permissions. After some experimentation, the following permissions seemed to work:

jobs:
  release:
    name: Prepare Release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
      packages: write
      pull-requests: write
      issues: read

[Andarist]

@hcg1023 so you have encountered a problem there because you were using a custom GitHub token with some missing scopes that are automatically included in the default token?

@smiley-uriux interesting, TIL about jobs.{{job}}.permissions.

I would be very much open for accepting PR that would be adding some kind of Security section to the docs.

[hcg1023]

@Andarist I'm using secrets.GITHUB_TOKEN, which should not be a custom GITHUB_TOKEN

[Andarist]

Ah - I see. I didn't realize that the permissions of this default token could have been changed like this. If you find a good place in the README to add this kind of information I would gladly merge a PR with such an addition

[airtonix]

Tried this out:

• have feature PR, lint/text yadda yadda
• merge feature PR
• master workflow runs:

name: Release Package

on:
  push:
    branches:
      - master

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
      packages: write
      pull-requests: write
      issues: read
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - run: git fetch --no-tags --prune --depth=5 origin master

      - name: asdf setup
        uses: asdf-vm/actions/setup@v1.1.0

      - name: asdf install
        run: |
          set -x
          asdf plugin add nodejs
          asdf install

      #
      # This step configures NPM
      #
      # - here we configure the registry for publishing
      - name: Setup publishing
        uses: actions/setup-node@v2
        with:
          registry-url: "https://npm.pkg.github.com"
      #
      # This step caches installed things
      #
      - name: Cache npm modules
        uses: actions/cache@v2
        env:
          cache-name: cache-npm-modules
        with:
          path: ~/.npm
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-

      #
      # Install things sensitive to the lockfile
      #
      - run: npm ci --ignore-scripts

      #
      #
      #
      - name: Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@21240c3cd1d2efa2672d64e0235a03cf139b83e6
        with:
          # This expects you to have a script called release which does a build for your packages and calls changeset publish
          publish: npm run release
        env:
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
          # this is the secret sauce for authenticating to our github npm registry
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Deploy 🚀
        uses: JamesIves/github-pages-deploy-action@v4.2.2
        if: steps.changesets.outputs.published == 'true'
        with:
          token: ${{ secrets.GIT_PUSH_TOKEN }}
          branch: gh-pages # The branch the action should deploy to.
          folder: docs # The folder the action should deploy.

• get Release PR 👍🏻
• merge Release PR
• wait until the end of time for new action to run and actually create a github release 💀

[airtonix]

So the reason it never runs the follow up workflow on master is because changesets makes a commit with a message containing [skip ci]

I've experimented with this a lot yesterday, and as we merge the "Version Packages" pr, i remove the [skip ci] from the message, then the next worflow runs and packages are deployed and a github release is made.

@Andarist we need a way to modify the commit message of the "Version Packages" pr to remove the [skip ci]