Thanks for the approval! It looks like the CI is failing due to the following issue:

The error Resource not accessible by integration occurs because this pull request originates from a branch in a forked repository. When workflows are triggered by pull requests from forks, the GITHUB_TOKEN provided by GitHub Actions only has read-only permissions. As a result, the workflow cannot perform actions like adding labels or posting comments.

What Needs to Happen:

This issue must be addressed in the upstream repository since the workflow and its permissions are controlled there. Here are some potential solutions for the upstream maintainers:

1. Enable Write Permissions for Fork Workflows:

   • Navigate to Settings > Actions > General for the repository.
   • Under Workflow permissions, select Read and write permissions and enable Allow GitHub Actions to create and approve pull requests.

2. Update the Workflow to Handle Forks:

   • Modify the workflow to skip actions requiring write permissions when the pull request comes from a fork:

     steps:
       - name: Check if PR is from a fork
         run: |
           if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
             echo "This is a forked PR. Steps requiring write permissions will be skipped."
           fi

3. Use a Personal Access Token (PAT):

   • Replace the GITHUB_TOKEN with a PAT that has write permissions. The PAT can be stored as a secret in the repository and referenced in the workflow.

4. Manually Apply Labels:

   • As a temporary workaround, required labels can be added manually by maintainers.

@michaelstingl I implemented 3), can you rebase?

Hi @micbar,

I've rebased the branch, but the workflow is still failing with Input required and not supplied: token in this run: https://github.com/opencloud-eu/opencloud/actions/runs/14513474466

After further research, the issue appears to be more fundamental: GitHub Actions never passes repository secrets to pull requests from forks for security reasons - even when PATs are stored as secrets.

The recommended solution would be to modify the label check job to only run on internal PRs:

jobs:
  label:
    # Only run if PR is not from a fork
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
    steps:
      - uses: mheap/github-action-required-labels@v5
        with:
          mode: minimum
          count: 1
          labels: |
            Type:Bug
            Type:Enhancement
            # ... more labels ...
          add_comment: true
          token: ${{ secrets.GH_TOKEN_OPENCLOUDERS }}

Alternatively, you could manually add the label so the PR can proceed. Thanks!

@michaelstingl Can you add the permissions check in your pr and remove the token setting? that would be awesome.

@micbar I've updated the PR to include the suggested changes:

1. Added a condition to only run the label check job for internal PRs (not from forks)
2. Removed the token setting as it's not needed for internal PRs

This should fix the workflow issue. Thanks for your help!