@types/github-script install fails in github action in dependabot pr's

[Quintisimo]

Describe the bug
When npm dependencies are being installed in a github action in a dependabot pr, it fails on @types/github-script with a permission denied error. I am using pnpm but I would assume this error occurs in all package managers.

To Reproduce
Steps to reproduce the behavior:

1. Install @types/github-script
2. Add a github action to run pnpm install
3. Wait for dependabot to create a pr and run pnpm install in github action
4. See error

Expected behavior
The install is successful

Screenshots

Desktop (please complete the following information):

• OS: linux

[joshmgross]

Can you include the full set of commands you're using to install the types?

[Quintisimo]

• To install the types in my project I ran: pnpm add -D @actions/github-script@github:actions/github-script
• In the github action I run:

    - name: Install pnpm
          uses: pnpm/action-setup@v4
          with:
            version: ${{ steps.pnpm_version.outputs.version }}
  
    - name: Install Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ steps.node_version.outputs.version }}
  
    - name: Install dependencies
      working-directory: ${{ inputs.working-directory }}
      shell: bash
      run: pnpm install
      env:
        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}

Just to note again this error only occurs in pr's that are created by dependabot for dependencies or security updates. The install works fine in normal pr's

@joshmgross

[joshmgross]

@Quintisimo where does node-auth-token come from?

If that's an Actions secret, is it also set as a Dependabot secret?

https://docs.github.com/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#investigating-failed-workflow-runs

[Quintisimo]

@joshmgross yes I have set it both as an action secret and a dependabot secret

[joshmgross]

Could you provide the full workflow?

[Quintisimo]

@joshmgross that is all the steps of the action. It is a custom org composite action that we use across multiple repos. Here is the it in full action.yml it is called setup-node-enivronment:

name: Setup Node Environment
description: Install Node, Pnpm, and dependencies

inputs:
  node-auth-token:
    description: Token to authenticate with npm registry
    required: true

  working-directory:
    description: The directory to run the install command in
    required: false
    default: ${{ github.workspace }}

runs:
  using: composite
  steps:
    - name: Get Pnpm Version from package.json
      id: pnpm_version
      working-directory: ${{ inputs.working-directory }}
      shell: bash
      run: |
        version=$(jq -r '.packageManager' package.json)
        echo "version=$(echo "$version" | sed 's/^pnpm@//')" >> $GITHUB_OUTPUT

    - name: Get Node Version from .nvmrc
      id: node_version
      working-directory: ${{ inputs.working-directory }}
      shell: bash
      run: |
        version=$(cat .nvmrc)
        echo "version=$version" >> $GITHUB_OUTPUT

    - name: Install pnpm
      uses: pnpm/action-setup@v4
      with:
        version: ${{ steps.pnpm_version.outputs.version }}

    - name: Install Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ steps.node_version.outputs.version }}

    - name: Install dependencies
      working-directory: ${{ inputs.working-directory }}
      shell: bash
      run: pnpm install
      env:
        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}

and here is how it is used in a workflow:

name: Linting
run-name: Linting

on:
  pull_request:

jobs:
  linting:
    name: Linting
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4

      - name: Setup node and install dependencies
        uses: The-Legal-Tech-Company/actions/src/setup-node-environment@main
        with:
          node-auth-token: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}

      - name: Run eslint
        run: pnpm lint

      - name: Run typecheck
        run: pnpm typecheck

      - name: Run test
        run: pnpm test

[joshmgross]

@Quintisimo this is a bit outside the scope of the actions/github-script action, but I'll try my best to help out.

Can you double check that PRIVATE_REGISTRY_TOKEN is set to the same value for both Actions and Dependabot secrets? And if that's an org secret ensure that it's shared with the same set of repositories.

That's the only clear difference I see here, nothing in this action or the exported types should differ for a Dependabot run.