bump-formula-pr : how does it work in GitHub interactions ?

[lelegard]

Hello,

This is maybe a dumb question but, surprisingly, I could not find any answer after an hour of googling.

How do you make bump-formula-pr work in practice?

Specifically, when you run brew bump-formula-pr -n, it displays a list of commands which will be run. However, some of them are generic, for instance:

...
==> try to fork repository with GitHub API
...
==> git push --set-upstream FORK_URL bump-srt-1.5.0:bump-srt-1.5.0
...
==> create pull request with GitHub API (base branch: master)

Where does it fork the homebrew-core repo? Using which GitHub user? Does it use the $HOMEBREW_GITHUB_API_TOKEN?

When I run this, I get an error "Unable to fork: Not Found!". My $HOMEBREW_GITHUB_API_TOKEN is set.

$ brew bump-formula-pr -f srt --version 1.5.0
...
Error: Unable to fork: Not Found!

Note: I use -f because another PR was created for the same formula by someone else but was closed and dropped a few days ago because of an issue on dependencies. It should work now, so I try to bump it again. I am not the author of the srt package, just a user who needs the new version.

I already have a forked repository at lelegard/homebrew-core where I do my PR manually. Can it be used? Is this the reason for "Unable to fork"?

If I add the open --no-fork, it ends up asking for Username for 'https://github.com': . Since GitHub has ceased to allow login / password access, this is a bit surprising. Anyway, I just type in my GitHub user name and the command stalls forever.

So, what does go wrong?

Can someone explain how does bump-formula-pr provides access credentials to fork and create the PR?

Thanks for your help and explanations.

[SMillerDev]

See HOMEBREW_GITHUB_API_TOKEN on
https://docs.brew.sh/Manpage.

[lelegard]

@SMillerDev, @Rylan12,

It seems to be an issue with the access rights of the personal access token. The one I used had read/write accesses on repositories and workflows. It generated the "Unable to fork: Not Found" error. As a test, I created a temporary token with all admin accesses (something I do not like...) and it worked.

I would recommend to precisely document the minimum list of required access rights for the token in the Homebrew documentation.

Creating a token with full access is not a recommended security practice. Having a precise list of the minimum requirements would be a better practice.

Thanks

[SMillerDev]

Note: Homebrew doesn’t require permissions for any of the scopes, but some developer commands may require additional permissions.

This note does exist in the documentation of the token variable.

The one I used had read/write accesses on repositories and workflows.

Did it have public:repo permissions?

[lelegard]

Did it have public:repo permissions?

Yes, the permissions are displayed as follow in the settings. All other permissions are unchecked.

[SMillerDev]

I'm not sure what is wrong then, since I have the same permissions set and my bump-* commands work.

[Rylan12]

Not sure what's going on here exactly so I may not be able to help, but can you post the output of brew config and brew bump-formula-pr -f srt --version 1.5.0 --debug?

Again, this could be helpful in trying to debug.

You could also try seeing if curl -X POST -H "Authorization: token $HOMEBREW_GITHUB_API_TOKEN" https://api.github.com/repos/Homebrew/homebrew-core/forks outputs anything unexpected. This API call should create a fork if one doesn't exist already.