issue labeler workflow failing

[david-luna]

latest dependabot PRs are failing in the issue labeler CI workflow and blocking the merge. The POST request failed with a 403 so we should start by checking if the token has expired or was rotated

Ref: https://github.com/elastic/apm-agent-nodejs/actions/runs/8042141883/job/21962393814?pr=3883

excerpt of the error

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/AlexanderWert/issue-labeler/v2.3/node_modules/@octokit/request/dist-node/index.js:66:23
    at processTicksAndRejections (node:internal/process/task_queues:96:5) {
  status: 403,
  headers: {
    'access-control-allow-origin': '*',
    'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
    connection: 'close',
    'content-encoding': 'gzip',
    'content-security-policy': "default-src 'none'",
    'content-type': 'application/json; charset=utf-8',
    date: 'Mon, 26 Feb 2024 01:02:07 GMT',
    'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
    server: 'GitHub.com',
    'strict-transport-security': 'max-age=3[15](https://github.com/elastic/apm-agent-nodejs/actions/runs/8042141883/job/21962393814?pr=3883#step:3:16)36000; includeSubdomains; preload',
    'transfer-encoding': 'chunked',
    vary: 'Accept-Encoding, Accept, X-Requested-With',
    'x-accepted-github-permissions': 'issues=write; pull_requests=write',
    'x-content-type-options': 'nosniff',
    'x-frame-options': 'deny',
    'x-github-api-version-selected': '2022-11-28',
    'x-github-media-type': 'github.v3; format=json',
    'x-github-request-id': 'BCF4:797F:65ED267:68FBC11:65DBE30E',
    'x-ratelimit-limit': '15000',
    'x-ratelimit-remaining': '14993',
    'x-ratelimit-reset': '1708912857',
    'x-ratelimit-resource': 'core',
    'x-ratelimit-used': '7',
    'x-xss-protection': '0'
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/elastic/apm-agent-nodejs/issues/3883/labels',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'octokit.js/[16](https://github.com/elastic/apm-agent-nodejs/actions/runs/8042141883/job/21962393814?pr=3883#step:3:17).43.2 Node.js/16.[20](https://github.com/elastic/apm-agent-nodejs/actions/runs/8042141883/job/21962393814?pr=3883#step:3:21).2 (Linux 6.2; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"labels":["agent-nodejs"]}',
    request: {
      hook: [Function: bound bound register],
      validate: {
        issue_number: { required: true, type: 'integer' },
        labels: { required: true, type: 'string[]' },
        number: { alias: 'issue_number', deprecated: true, type: 'integer' },
        owner: { required: true, type: 'string' },
        repo: { required: true, type: 'string' }
      }
    }
  },
  documentation_url: 'https://docs.github.com/rest/issues/labels#add-labels-to-an-issue'
}

[trentm]

#3885 opened for this.

[trentm]

Nope. I didn't add perms to the needed job in the labeler workflow.

[trentm]

That didn't work. Or at least likely didn't work. I just got another failure:
https://github.com/elastic/apm-agent-nodejs/actions/runs/8191312536

Invalid workflow file: .github/workflows/labeler.yml#L23
The workflow is not valid. .github/workflows/labeler.yml (Line: 23, Col: 7): Unexpected value 'permissions' .github/workflows/labeler.yml (Line: 48, Col: 7): Unexpected value 'permissions'

[trentm]

The labeler workflow is always failing now: https://github.com/elastic/apm-agent-nodejs/actions/workflows/labeler.yml

[trentm]

Nope. That didn't work.

https://github.com/elastic/apm-agent-nodejs/actions/runs/8210315149/job/22457519729

Adding labels agent-nodejs to issue #3905
/home/runner/work/_actions/AlexanderWert/issue-labeler/v2.3/node_modules/@octokit/request/dist-node/index.js:66
        const error = new requestError.RequestError(message, status, {
                      ^

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/AlexanderWert/issue-labeler/v2.3/node_modules/@octokit/request/dist-node/index.js:66:23
    at processTicksAndRejections (node:internal/process/task_queues:96:5) {
  status: 403,
  headers: {
    'access-control-allow-origin': '*',
    'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
    connection: 'close',
    'content-encoding': 'gzip',
    'content-security-policy': "default-src 'none'",
    'content-type': 'application/json; charset=utf-8',
    date: 'Fri, 08 Mar 2024 23:39:55 GMT',
    'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
    server: 'GitHub.com',
    'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
    'transfer-encoding': 'chunked',
    vary: 'Accept-Encoding, Accept, X-Requested-With',
    'x-accepted-github-permissions': 'issues=write; pull_requests=write',
    'x-content-type-options': 'nosniff',
    'x-frame-options': 'deny',
    'x-github-api-version-selected': '2022-11-28',
    'x-github-media-type': 'github.v3; format=json',
    'x-github-request-id': '38CC:065E:E5C293:1B7E910:65EBA1CB',
    'x-ratelimit-limit': '15000',
    'x-ratelimit-remaining': '14998',
    'x-ratelimit-reset': '1709944795',
    'x-ratelimit-resource': 'core',
    'x-ratelimit-used': '2',
    'x-xss-protection': '0'
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/elastic/apm-agent-nodejs/issues/3905/labels',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'octokit.js/16.43.2 Node.js/16.20.2 (Linux 6.5; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"labels":["agent-nodejs"]}',
    request: {
      hook: [Function: bound bound register],
      validate: {
        issue_number: { required: true, type: 'integer' },
        labels: { required: true, type: 'string[]' },
        number: { alias: 'issue_number', deprecated: true, type: 'integer' },
        owner: { required: true, type: 'string' },
        repo: { required: true, type: 'string' }
      }
    }
  },
  documentation_url: 'https://docs.github.com/rest/issues/labels#add-labels-to-an-issue'
}

Lovely. That documentation_url says:

The token must have at least one of the following permission sets:

issues:write
pull_requests:write

and I added the former for those two:

apm-agent-nodejs/.github/workflows/labeler.yml

Lines 10 to 14 in 7a697bc

	permissions:
	contents: read
	# This permission is needed to add labels to issues/PRs per
	# https://docs.github.com/en/rest/issues/labels?apiVersion=2022-11-28#add-labels-to-an-issue
	issues: write

based on what I saw in the .NET agent here:
https://github.com/elastic/apm-agent-dotnet/blob/2805f3ada1940d48ad0b2f90753de19e2995743a/.github/workflows/labeler.yml#L8-L10

I assume my comment isn't impactful.

This one is getting frustrating.

[trentm]

This one is getting frustrating.

And it continues...

The labeler workflow is now failing with:

Run actions-ecosystem/action-add-labels@v1
Error: HttpError: Resource not accessible by integration
Error: Resource not accessible by integration

e.g.: https://github.com/elastic/apm-agent-nodejs/actions/runs/8325325014

next

Next attempt will be to switch to the technique(s) being used in apm-agent-java which Riccardo (internal Slack comment: https://elastic.slack.com/archives/C9A6ANR5Y/p1710418037227959) confirmed is "the way" now.

[trentm]

5th time's the charm.