Package manager versions outdated

Version Sync workflow fails with "Resource not accessible by integration"

Issue

The workflow Version Sync, mentioned in CONTRIBUTING.md "that keeps pinned versions up-to-date", is scheduled to run weekly, has been failing since Sep 2024.

Consequently, versions in config.json are months out of date (apart from Yarn 1 Classic where there has been no new version released):

Package Manager	`config` version	`latest` version
npm	`10.9.1`	`11.0.0`
pnpm	`9.14.2`	`9.15.3`
Yarn (classic)	`1.22.22`	`1.22.22`
Yarn	`4.5.2`	`4.6.0`

Logs

Jan 10, 2025 https://github.com/nodejs/corepack/actions/runs/12700915343/job/35404505886

Error: Resource not accessible by integration

Run gr2m/create-or-update-pull-request-action@77596e3166f328b24613f7082ab30bf2d93079d5
Remote branch "actions/tools-update-config.json" checked out locally.
RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/gr2m/create-or-update-pull-request-action/77596e3166f328b24613f7082ab30bf2d93079d5/dist/index.js:9160:21
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async main (/home/runner/work/_actions/gr2m/create-or-update-pull-request-action/77596e3166f328b24613f7082ab30bf2d93079d5/dist/index.js:792:9) {
  status: 403,
  response: {
    url: 'https://api.github.com/repos/nodejs/corepack/pulls',
    status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      connection: 'close',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Fri, 10 Jan 2025 00:32:07 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'github.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-accepted-github-permissions': 'pull_requests=write',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3; format=json',
      'x-github-request-id': '68A9:3E2E99:172181E:2E21CFC:67806A87',
      'x-ratelimit-limit': '15000',
      'x-ratelimit-remaining': '14996',
      'x-ratelimit-reset': '1736472688',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '4',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Resource not accessible by integration',
      documentation_url: 'https://docs.github.com/rest/pulls/pulls#create-a-pull-request',
      status: '403'
    }
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/nodejs/corepack/pulls',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'octokit-core.js/3.5.1 Node.js/20.18.0 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"title":"feat: update package manager versions","body":"This is an automated update of package manager versions","head":"actions/tools-update-config.json","base":"main"}',
    request: { hook: [Function: bound bound register] }
  }
}
Error: Resource not accessible by integration

@aduh95

Looks like @aduh95 might have permission to fix this.

Looks like the repo settings need to be changed per gr2m/create-or-update-pull-request-action#557 (comment)

@styfle

@styfle

Looks like @aduh95 might have permission to fix this.

Looks like the repo settings need to be changed per gr2m/create-or-update-pull-request-action#557 (comment)

chore: fix sync.yml permissions #554 also mentions permissions

@arcanis

Possibly @arcanis or @aduh95 (or whoever is currently organizationally responsible) should check their settings for Notifications for workflow runs. If enabled, GitHub would send a failure notification. I don't really understand otherwise how the workflow could be failing for the last 4 months without any apparent attempt to fix it.

Maybe it has changed since last time I tried enable it, but I find GitHub failure notification not worth the noise, so I'm not enabling that, no thank you.

Looks like the repo settings need to be changed per gr2m/create-or-update-pull-request-action#557 (comment)

No those are disabled at the org level:

The options we have are:

stop using https://github.com/gr2m/create-or-update-pull-request-action, we could simply push the changes and create the PR using API calls.
Request a bot token with the correct permission to keep using gr2m action.
Do nothing/keep updating the config file manually.

It's a volunteer based project, so until someone commits their time on that issue, the latter will apply. Worth noting that the internal config file is only used when COREPACK_DEFAULT_TO_LATEST is set to 0 in the env, so being behind there won't affect most Corepack users – but we should still fix it, at least because it allows us to test Corepack with latest versions of supported package managers.

@aduh95

@aduh95

I am able to run the workflow in a fork by adding pull_requests: write permissions. It looks like this was all that was missing.

    permissions:
      contents: write
      pull-requests: write

It then created a PR build(deps): bump actions/setup-node from 5.0.0 to 6.3.0 MikeMcC399/corepack#2 for me

@aduh95

@aduh95

I went ahead and submitted chore: add pull_requests: write permissions to sync workflow #593. If you, or one of the other maintainers, would like to approve the PR workflow running, we should be able to close this issue. I haven't submitted to this repo previously, so GitHub doesn't run the workflows unless approved.

PR chore: add pull_requests: write permissions to sync workflow #593 is now merged
This gives Version Sync (sync.yml) privileges to create a PR
Now either a maintainer with write privileges to the repo needs to run Version Sync manually OR
if there is no manual intervention it will next run according to
```
# Run once a week at 00:05 UTC on Friday.
- cron: 5 0 * * 5
```
which would be Friday, Jan 17, 2025
Running the workflow should generate a PR

@aduh95

@aduh95

Would you like to manually trigger the workflow Version Sync now or do you prefer to wait for cron to kick in on Friday?

I've ran it manually for you: https://github.com/nodejs/corepack/actions/runs/12765046315/job/35578428609

Looks it's working great, thanks

@aduh95

@aduh95

I've ran it manually for you: https://github.com/nodejs/corepack/actions/runs/12765046315/job/35578428609

Looks it's working great, thanks

It's great to see that the workflow is successful.

This issue is however not resolved until feat: update package manager versions #595 is merged, otherwise the changes are not pushed into production.
... and I guess that a new release of corepack needs to be done chore(main): release 0.31.0 #596
... and then that release would need to be bundled into releases of Node.js in order to reach regular users Node.js LTS rollout of minimum Corepack 0.31.0? #627

Navigation Menu

Repository navigation

Package manager versions outdated #590

Issue

Logs

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Package manager versions outdated #590

Description

Issue

Logs

Activity

styfle commented on Jan 12, 2025

MikeMcC399 commented on Jan 12, 2025

MikeMcC399 commented on Jan 13, 2025

aduh95 commented on Jan 13, 2025

MikeMcC399 commented on Jan 13, 2025

MikeMcC399 commented on Jan 13, 2025

MikeMcC399 commented on Jan 13, 2025

MikeMcC399 commented on Jan 13, 2025

MikeMcC399 commented on Jan 13, 2025

MikeMcC399 commented on Jan 14, 2025

aduh95 commented on Jan 14, 2025

MikeMcC399 commented on Jan 14, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions