openedx SEMANTIC_RELEASE_GITHUB_TOKEN secret lacks permissions to publish a release on GitHub

[OmarIthawi]

Description

This repo uses the release.yml GitHub workflow which runs the semantic-release npm package to publish GitHub releases and uploads the atlas binary to it.

The npx semantic-release fails on this repo when the secrets.SEMANTIC_RELEASE_GITHUB_TOKEN is being used and the GitHub API returns a 404 error, which is sometimes another way to say permission error.

Here's the failed job attempt https://github.com/openedx/openedx-atlas/actions/runs/5786749334/attempts/1 with a 404 error

RequestError [HttpError]: Not Found
    at /home/runner/.npm/_npx/d32d92066bae6c10/node_modules/@octokit/request/dist-node/index.js:112:21
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async requestWithGraphqlErrorHandling (/home/runner/.npm/_npx/d32d92066bae6c10/node_modules/@octokit/plugin-retry/dist-node/index.js:71:20)
    at async Job.doExecute (/home/runner/.npm/_npx/d32d92066bae6c10/node_modules/bottleneck/light.js:405:18) {
  status: 404,
  response: {
    url: 'https://api.github.com/repos/openedx/openedx-atlas/releases',
    status: 404,

Current workaround

Because this affects the wider @openedx GitHub repository @brian-smith-tcril and I chose not to edit the SEMANTIC_RELEASE_GITHUB_TOKEN.

We opted to use the github.token on the release.yml workflow instead. However, the github.token could be a bit less secure since it grants wider permissions as far as I know:

• Fix: fix: use github.token to debug the sem-release issue #32

The release process now works well and upload the binary successfully: https://github.com/openedx/openedx-atlas/releases/tag/v0.2.0

The updated workflow looks like the following:

openedx-atlas/.github/workflows/release.yml

Lines 16 to 18 in 18eb0cc

	- name: semantic release
	env:
	GITHUB_TOKEN: ${{ github.token }}

Suggested fix

Update the @openedx organization-wide secret to include permissions to manage the releases, upload artifacts, etc -- I don't really know what how to fix it because I don't have access to see what's in the SEMANTIC_RELEASE_GITHUB_TOKEN permissions list.