Incompatible with actions/checkout v6

[marcelotduarte]

After updating to actions/checkout v6, I started receiving permission errors: https://github.com/marcelotduarte/cx_Freeze/actions/runs/19579192016/job/56103974195

Reverting to 5.0.1 fixed the error: marcelotduarte/cx_Freeze@99e9256

Checking the changelog of actions/checkout, I think this is root of the issue:

• Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.
  • This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

[scottgigante-hubflow]

I'm currently running checkout v5.0.1 and I'm also getting new permissions errors. Nothing about my workflow has changed afaik.

Details

Run actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
[...]
Run py-cov-action/python-coverage-comment-action@e623398c19eb3853a5572d4a516e10b15b5cefbc
  with:
    GITHUB_TOKEN: ***
    GITHUB_BASE_URL: https://api.github.com/
    COVERAGE_DATA_BRANCH: python-coverage-comment-action-data
    COVERAGE_PATH: .
    COMMENT_ARTIFACT_NAME: python-coverage-comment-action
    COMMENT_FILENAME: python-coverage-comment-action.txt
    MINIMUM_GREEN: 100
    MINIMUM_ORANGE: 70
    MAX_FILES_IN_COMMENT: 25
    MERGE_COVERAGE_FILES: false
    ANNOTATE_MISSING_LINES: false
    ANNOTATION_TYPE: warning
    USE_GH_PAGES_HTML_URL: false
    VERBOSE: false
  env:
    pythonLocation: /opt/hostedtoolcache/Python/3.13.9/x64
    PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.13.9/x64/lib/pkgconfig
    Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.13.9/x64
    Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.13.9/x64
    Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.13.9/x64
    LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.13.9/x64/lib
    PGSERVICEFILE: /home/runner/work/_temp/pgdata/pg_service.conf
/usr/bin/docker run --name fbfa8321a73f7edf44db961141e39c58150e_64ed2c --label 27fbfa --workdir /github/workspace --rm -e "pythonLocation" -e "PKG_CONFIG_PATH" -e "Python_ROOT_DIR" -e "Python2_ROOT_DIR" -e "Python3_ROOT_DIR" -e "LD_LIBRARY_PATH" -e "PGSERVICEFILE" -e "INPUT_GITHUB_TOKEN" -e "INPUT_GITHUB_BASE_URL" -e "INPUT_GITHUB_PR_RUN_ID" -e "INPUT_COMMENT_TEMPLATE" -e "INPUT_COVERAGE_DATA_BRANCH" -e "INPUT_COVERAGE_PATH" -e "INPUT_COMMENT_ARTIFACT_NAME" -e "INPUT_COMMENT_FILENAME" -e "INPUT_SUBPROJECT_ID" -e "INPUT_MINIMUM_GREEN" -e "INPUT_MINIMUM_ORANGE" -e "INPUT_MAX_FILES_IN_COMMENT" -e "INPUT_MERGE_C
Notice: Starting action
Notice: HTTP Request: GET https://api.github.com/repos/hubflowai/hubflow-api "HTTP/1.1 200 OK"
Notice: Generating comment for PR
Notice: HTTP Request: GET https://api.github.com/repos/hubflowai/hubflow-api/compare/staging...main "HTTP/1.1 200 OK"
Notice: HTTP Request: GET https://api.github.com/repos/hubflowai/hubflow-api/contents/data.json?ref=python-coverage-comment-action-data "HTTP/1.1 200 OK"
Notice: HTTP Request: GET https://api.github.com/repos/hubflowai/hubflow-api/pulls?state=open&head=hubflowai%3Amain&sort=updated&direction=desc "HTTP/1.1 200 OK"
Notice: HTTP Request: GET https://api.github.com/repos/hubflowai/hubflow-api/pulls?state=all&head=hubflowai%3Amain&sort=updated&direction=desc "HTTP/1.1 200 OK"
Notice: HTTP Request: GET https://api.github.com/user "HTTP/1.1 403 Forbidden"
Notice: HTTP Request: GET https://api.github.com/repos/hubflowai/hubflow-api/issues/1382/comments "HTTP/1.1 200 OK"
Notice: Update previous comment
Notice: HTTP Request: PATCH https://api.github.com/repos/hubflowai/hubflow-api/issues/comments/3005830659 "HTTP/1.1 502 Bad Gateway"
Error: Critical error. This error possibly occurred because the permissions of the workflow are set incorrectly. You can see the correct setting of permissions here: https://github.com/py-cov-action/python-coverage-comment-action#basic-usage
Otherwise please look for open issues or open one in https://github.com/py-cov-action/python-coverage-comment-action/
Traceback (most recent call last):
  File "/workdir/coverage_comment/github_client.py", line 207, in http
    response.raise_for_status()
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/local/lib/python3.14/site-packages/httpx/_models.py", line 829, in raise_for_status
    raise HTTPStatusError(message, request=request, response=self)
httpx.HTTPStatusError: Server error '502 Bad Gateway' for url 'https://api.github.com/repos/hubflowai/hubflow-api/issues/comments/3005830659'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/502

The above exception was the direct cause of the following exception:

Traceback (most recent cal

(and yes, the traceback is cut off in the logs too)

[thekaveman]

We had seen failures earlier today after upgrading to actions/checkout@v6... but then we had a successful coverage comment posted on our most recent PR, with no other workflow changes 🤔

cal-itp/benefits#3346 (comment)

[ewjoachim]

Hm, we recently merged stuff related to persist-credentials but those were only documentation changes, and they haven't been released, so it sounds like a coincidence ?

[marcelotduarte]

I had tested it because I saw this documentation, but it didn't work. During the PR it works, it updates the comment, but when it does the merge, it gives an error.
I try this here.
The error can be view here.

[marcelotduarte]

@ewjoachim I noticed in another project that they also had an incompatibility issue, and it was resolved (I believe by the checkout maintainer). Take a look; perhaps it will inspire you to show you what to do to fix it:
peter-evans/create-pull-request#4230

[marcelotduarte]

Updating to python-coverage-comment-action 3.40 and checkout 6.0.2 with persist-credentials true works.
marcelotduarte/cx_Freeze@9e1ad43#diff-b803fcb7f17ed9235f1e5cb1fcd2f5d3b2838429d4368ae4c57ce4436577f03fR143-R147