[actions] Cannot use an action hosted in a private repository owned by the same user

[thomas-maurice]

Description

It does not seem to be possible to use an action hosted on a private gitea instance (the runner being registered on the said instance, and the user owning both repos), the runner fails in the setup phase with:

Unable to clone https://XXX/thomas/actions refs/heads/latest: authentication required

The sample .gitea/workflows/pr.yml I used was

---
name: Test pull requests
run-name: ${{ github.actor }} is doing a PR
concurrency:
  cancel-in-progress: true
on: [pull_request]
jobs:
  "Test and build":
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
      repository-projects: read
    steps:
      - uses: https://XXX/thomas/actions/setup@latest

As you see I tried to add a bunch of permissions but it didn't seem to do anything (I was working under the assumption these would work the same as github, might be wrong)

I also tried to put an ssh:// cloning scheme but it failed as well with

Expected format {org}/{repo}[/path]@ref. Actual 'ssh://gitea@XXXXXXXX:PORT/thomas/actions/setup@latest' Input string was not in a correct format

Gitea Version

1.19.3

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

2.34.1

Operating System

Ubuntu 22.04

How are you running Gitea?

Stock binary downloaded from github

Database

PostgreSQL

[wolfogre]

I understand. However, permissions doen't not work on Gitea Actions yet. See https://docs.gitea.io/en-us/usage/actions/comparison/#permissions-and-jobsjob_idpermissions

Therefore, the job can only access the related repository and not other private repositories.

[thomas-maurice]

Oooooh, it makes sense @wolfogre thank you! I wasn't sure if it was a bug or because the feature is still in early days. Thank you for clarifying !

[wolfogre]

And a proposal for this:

• [Proposal] Support configuring permissions of automatic tokens of Actions jobs #24635

[thomas-maurice]

Thank you for following up :)

[yarkovaleksei]

@thomas-maurice I found a working solution to the problem

name: test_access_to_private_repo

on:
  push: ~

jobs:
  run-script-job:
    runs-on: ubuntu-latest
    name: Test access to private repo
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.1
        with:
          fetch-depth: 0

      - name: Run action from private repo
        uses: https://${{ vars.ci_access_token }}@git.selfhosted.com/org/repo@main
        with:
          param: "value"

[Frankkkkk]

It would be even better with #24635

[lunny]

This has been resolved by #32562

[chrisliebaer]

Is there any official documentation on how this should work? I just tried on 1.25.3. Put an action into a action/test repository on my instance, set the repository to public, the instance to private.

  ☁  git clone 'https://DOMAIN/actions/test' # ref=master
  cloning https://DOMAIN/actions/test to /home/rootless/.cache/act/dbea3e4dcafc00be4e7df7540827cfc272b635527c7c492b907626676570a3c2
Unable to clone https://DOMAIN/actions/test refs/heads/master: authentication required: Unauthorized

Am I wrong to believe that this should now be possible? Is there anything I need to configure? The issue linked by @lunny does not talk about private instances specifically, just about private repositories, which would mean that this issue is not resolved.

[lunny]

This feature will be included in version 1.26, but it has not been released yet.