What permissions are required to execute the action?

[theofidry]

I have the project https://github.com/box-project/box which publishes an artifact box.phar that is uploaded to each release. I also have the homebrew formula living in https://github.com/box-project/homebrew-box, which requires the tap humbug/box.

Keeping it up to date has been a bit tedious so I'm trying to automate it via this action. I have the following configuration in https://github.com/box-project/box:

    publish-homebrew-tap:
        runs-on: ubuntu-latest
        name: Publish Homebrew tap
        needs:
            - publish-phar
        if: github.event_name == 'release'
        steps:
            -   name: Update Homebrew formula
                uses: dawidd6/action-homebrew-bump-formula@v3
                with:
                    token: ${{ secrets.BOX_HOMEBREW_TAP_TOKEN }}
                    tap: box-project/box
                    formula: box
                    tag: ${{ github.event.release.tag_name }}
                    revision: ${{ github.event.release.target_commitish }}

(the full workflow can be found here)

The BOX_HOMEBREW_TAP_TOKEN is a fine-grained access token which has access to:

• The repositories box-project/box and box-project/homebrew-box
• Read access to metadata
• Read and Write access to actions, code, commit statuses, pull requests, and workflows

I expected this to be enough but that does not seem to be the case: https://github.com/box-project/box/actions/runs/4330997891/jobs/7562608715#step:2:233

Do you know by any chance what fine-grained permissions are required to make it work?

[dawidd6]

No permission to fork a repository? Frankly I'm not sure. Maybe other users could help you.