[Question]: GitHub App authentication to download dependencies from another organization

[amunoz-ldr]

Question

I am using AL-Go for GitHub v6.4 and would like to know if it is possible to use GitHub App authentication to download dependencies from a repository in another organization that belongs to the same account where the GitHub App was created.

If so, what permissions need to be granted? I have followed the documentation to create a GhTokenWorkflow, but it doesn’t seem to be enough. The "Update AL-GO system files" action runs successfully, but the CI/CD pipeline fails with the following error: The remote server returned an error: (403) Forbidden. ... at FindLatestSuccessfulCICDRun

I have configured the following permissions for the GitHub App:

Actions: Read-only
Contents: Read and write
Pull requests: Read and write
Workflows: Read and write

Are there additional permissions required to allow authentication and access to repositories in another organization within the same account?

Thanks in advance.
Alejandro.

[freddydk]

You are using the appDependencyProbingPaths and inside that specifying a secret, which contains an app id + key - I assume?

I will investigate whether that is possible today or we need to do something in order to make this work.

[amunoz-ldr]

Yes, this one:

"appDependencyProbingPaths": [
    {
      "repo": "https://github.com/org/repo",
      "authTokenSecret": "GHTOKENWORKFLOW",
      "release_status": "latestbuild",
      "projects": "*"
    }
  ],

The GhToken is the same used for UpdateAlGoSystemFiles

[freddydk]

Did you install the GitHub App in the other organization (the organization in which you have a dependency) and give it access to the repositories in question?
I would assume that this would be required.

[amunoz-ldr]

Yes, in fact, the repo is in the same organization, and the GitHub App has permissions for all repositories.

[freddydk]

Sounds like a bug - will investigate

[freddydk]

@amunoz-ldr - is the GitHub app installed in all repositories as well?

[amunoz-ldr]

The GitHub App is installed in the organization with access to all repositories. Within each repository, it can be seen as installed in the GitHub Apps section. I'm not sure if that's what you're referring to.

[freddydk]

it is - can you show me this part of your log in Download Project Dependencies:

[freddydk]

Which errors do you get?

[amunoz-ldr]

Sure:

Downloading project dependencies from probing paths
  Checking type
  Checking appFolders, testFolders and bcptTestFolders
  Application Dependency 25.0.0.0
  Updating app- and test Dependencies
  Analyzing Test App Dependencies
  No performance test apps found in bcptTestFolders in .AL-Go\settings.json
  Checking appDependencyProbingPaths
  Dependency to projects '*' in https://github.com/orgname/reponame@main, version latest, release status latestbuild
  Using secret GHTOKENWORKFLOW for access to repository
  Locating Apps artifacts for projects: *
  Using GitHub App with ClientId Iv23li5YV9Nlcjho7lGp for authentication
  Get App Info https://api.github.com/repos/orgname/reponame/installation
  Get Token Response https://api.github.com/app/installations/62916296/access_tokens with {"repositories":["reponame"],"permissions":{"metadata":"read","contents":"read"}}
  Finding latest successful CICD run for branch main in repository orgname/reponame, checking last 90 days
  - https://api.github.com/repos/orgname/reponame/actions/runs?per_page=100&page=1&exclude_pull_requests=true&status=completed&branch=main&created=>2025-01-16T10:10:01.6421446Z
  The remote server returned an error: (403) Forbidden. 
  
  Forbidden
  
  Applying settings from D:\a\integraciones\integraciones\.github\AL-Go-Settings.json
  Applying settings from D:\a\integraciones\integraciones\.AL-Go\settings.json
  No settings found in D:\a\integraciones\integraciones\.github\CICD.settings.json
  No settings found in D:\a\integraciones\integraciones\.AL-Go\CICD.settings.json
  No settings found in D:\a\integraciones\integraciones\.AL-Go\amunoz-ldr.settings.json
  Enabling Microsoft telemetry...
  Error: Unexpected error when running action. Error Message: The remote server returned an error: (403) Forbidden.   Forbidden , StackTrace: at InvokeWebRequest, D:\a\_actions\microsoft\AL-Go-Actions\v7.0\Github-Helper.psm1: line 112 <- at FindLatestSuccessfulCICDRun, D:\a\_actions\microsoft\AL-Go-Actions\v7.0\Github-Helper.psm1: line 872 <- at GetArtifacts, D:\a\_actions\microsoft\AL-Go-Actions\v7.0\Github-Helper.psm1: line 1027 <- at GetDependencies, D:\a\_actions\microsoft\AL-Go-Actions\v7.0\Github-Helper.psm1: line 176 <- at DownloadDependenciesFromProbingPaths, D:\a\_actions\microsoft\AL-Go-Actions\v7.0\DownloadProjectDependencies\DownloadProjectDependencies.Action.ps1: line 24 <- at <ScriptBlock>, D:\a\_actions\microsoft\AL-Go-Actions\v7.0\DownloadProjectDependencies\DownloadProjectDependencies.Action.ps1: line 123 <- at <ScriptBlock>, D:\a\_temp\1453fbf7-c46d-4c43-a7bf-45d86d58e960.ps1: line 3 <- at <ScriptBlock>, D:\a\_actions\microsoft\AL-Go-Actions\v7.0\Invoke-AlGoAction.ps1: line 17 <- at <ScriptBlock>, D:\a\_temp\1453fbf7-c46d-4c43-a7bf-45d86d58e960.ps1: line 2 <- at <ScriptBlock>, <No file>: line 1
  Error: Process completed with exit code 1.

[freddydk]

And, the orgname is the same as the org in which the workflow is running?
And the selected permissions are
Actions: Read-only
Contents: Read and write
Pull requests: Read and write
Workflows: Read and write

Could you try to add Read and Write to Administration, Packages and Pages (I don't think that matters - but I have those and mine works)

[amunoz-ldr]

Both repos are in the same organization, but same error with new permissions,

[freddydk]

Will see when I can get that in preview - it will be in v7.1

[amunoz-ldr]

Thanks a lot! Looking forward to seeing it in v7.1 🙌

[freddydk]

Working on getting this in preview today

[freddydk]

Shipped in preview