force-push performed with `github-actions` bot's token about create-pull-request HOT 4 CLOSED

@menny Thanks for reporting this issue. I think the reason for this is that v2 of checkout now preserves authentication for later use. If you don't provide a token it uses the default GITHUB_TOKEN. So it might be using that preserved token to push instead of the token set by the action. If this is case, I will investigate how to fix this so that the token passed to the action overrides the one set at checkout.

You can try adding your PAT to checkout as a workaround.

      - uses: actions/checkout@v2
        with:
          token: ${{ secrets.BOT_MASTER_RW_GITHUB_TOKEN }}

from create-pull-request.

nice :)
will try and let you know.

from create-pull-request.

@menny I've now fixed this with the latest release so that you don't need to add your PAT to actions/checkout. The action should now correctly use the passed token to push.

from create-pull-request.

@menny Going to close this issue now because I'm fairly confident that it's fixed. Please let me know if you see any further issues.

from create-pull-request.