Release drafter doesn't find existing draft

[jviolas]

It seems release-drafter can't find a draft to update anymore.

I have 9 releases in my repo and 1 draft.
release-drafter logs Found 9 releases and then No draft release found
The first log should include all the releases, even draft. So I should see Found 10 releases.
I don't have a filter by commitish and even so, the first log happens before releases are filtered.

Right now, every time the action is running, a new draft is created in the repo.

[jetersen]

Action or App? If action, what tag are you using for the action?

Can you link to it or share a snippet?

[robbinjanssen]

I was noticing the same, release-drafter keeps creating new drafts.

I think Github updated something on their end. The docs state that "Information about published releases are available to everyone. Only users with push access will receive listings for draft releases."

Does the release-drafter action have "push access"?

[robbinjanssen]

@jetersen see https://github.com/exonet/powerdns-php/runs/5320582314?check_suite_focus=true and https://github.com/exonet/powerdns-php/releases

[jetersen]

#1065 is not released under v5 so you should be fine?

[robbinjanssen]

Yeah that's my bad, I was searching why it wouldn't match my "target commitish" but that PR has nothing to do with it, turns out the action no longer receives draft releases.

When I try "listReleases" via the action with some debugging I get:

Tag v21.4.0 - target: master - Draft: false
Tag v21.3.9 - target: v21.3.x - Draft: false
Tag v21.3.8 - target: v21.3.x - Draft: false
Tag v21.3.7 - target: v21.3.x - Draft: false

When I do "listReleases" using my own token:

Tag v21.5.0 - target: master - Draft: true
Tag v21.4.1 - target: v21.4.x - Draft: true
Tag v21.4.0 - target: master - Draft: false
Tag v21.3.9 - target: v21.3.x - Draft: false
Tag v21.3.8 - target: v21.3.x - Draft: false
Tag v21.3.7 - target: v21.3.x - Draft: false

[jviolas]

I use the action and my tag is a version number 7.0.4

But I think it's more an issue from what github returns when listing releases. As @robbinjanssen says draft seems to be missing from the result of listReleases when release-drafter calls it.

[robbinjanssen]

I've just swapped out the ${{ secrets.GITHUB_TOKEN }} for a token created at my account and now it can find drafts again.

So this definitely has something to do with the action token's access and the github release endpoint

[jviolas]

In repository settings -> Actions -> General, when checking Read and write permissions, I thought it was supposed to give the correct right to the secrets.GITHUB_TOKEN.
Did something changes about that?

[robbinjanssen]

I haven't changed any action setting and have "Read and write permissions" enabled. I'm trying to find out if the endpoint or permission set has changed don't really know where to look

[jimwheaton]

I'm experiencing the exact issue as @jviolas, with v5.

[ecarruda]

I am experiencing exactly the same issue in all my company repos, testing locally and on GH Actions with a custom PAT it is working properly good, looks like something about GITHUB_TOKEN permission was changed or broken by GH team. I have some custom workflows working on GitHub Actions and I confirmed that I am having exactly the same problem. So it is not related to release-drafter but to GitHub team.

[ecarruda]

It seems release-drafter can't find a draft to update anymore.

I have 9 releases in my repo and 1 draft. release-drafter logs Found 9 releases and then No draft release found The first log should include all the releases, even draft. So I should see Found 10 releases. I don't have a filter by commitish and even so, the first log happens before releases are filtered.

Right now, every time the action is running, a new draft is created in the repo.

It makes totally sense because release-drafter can't find any draft release on the repo. It is related to GITHUB_TOKEN permissions. They closed one Issue about something related in January 21, but looks to still have some problem on it. I commented on the closed issue but no answer since yesterday.

[zack-sampson]

@ecarruda can you link the issue? Since yesterday at about 4PM ET the release drafter app hasn't been working at all for us and I'm wondering if it's related.

[jetersen]

Since the last v5 release is a while ago (19 days ago), I think this might be an change on either GitHub actions default token permissions or GitHub API changes.

[ecarruda]

@ecarruda can you link the issue? Since yesterday at about 4PM ET the release drafter app hasn't been working at all for us and I'm wondering if it's related.

cli/cli#3037

[jetersen]

I thought it might be related to GitHub action repo permissions, but looking at release-drafter/release-drafter repo settings for actions it should have write permissions by default:

[ecarruda]

I thought it might be related to GitHub action repo permissions, but looking at release-drafter/release-drafter repo settings for actions it should have write permissions by default:

it is like this in all my repos, new draft always can be created by you can't see draft releases with git GITHUB_TOKEN, so for sure it is not about this kind of permission. At least it doesn't make sense to me.

[NotMyFault]

Everything should work again.
I had a chat with a GitHub staff member earlier:

Our team verified today that a releases feature flag that was enabled yesterday caused the experienced behavior with accessing draft releases from API calls authenticated with GITHUB_TOKEN.

This flag was disabled earlier today, so accessing draft releases via API should work as expected again. This flag will remain disabled until our engineering team investigates and addresses the impact it had on using GITHUB_TOKEN.

I can verify it works again, I just had to delete the duplicated drafts to tidy the mess up, but release drafter edits the latest draft fine again.

[robbinjanssen]

Working for me as well, i think we can close this issue :-)

[tdeheurles]

I also confirm bug is gone for us @NotMyFault thanks

[ssbarnea]

Also confirming the same bug, affecting https://github.com/ansible-community/molecule/releases -- what surprises me is that I did not see it in other projects with similar setup.

I do think I have an idea why I get this as the release drafter workflow is kept in a shared pipline hosted inside https://github.com/ansible-community/devtools/blob/main/.github/workflows/push.yml -- and there is no passing of any credentials.

Still, I find it hilarious to be able to create new draft but not to be able to see existing ones. It does not make much sense from the security point of view.