Unable to merge PRs from external contributors due to check failures

[cpcallen]

Describe the bug

PR #5656 has two checks which are failing with Error: Unhandled error: HttpError: Resource not accessible by integration.

A quick search turns up related bug reports against actions/first-interaction and actions/labeler; from the resolution to the latter it is apparent that this is a known issue and that GitHub action are severely limited on PRs from forks; I believe this is what is happening here: when actions are run for a PR which is from a fork, they have read-only access to the GitHub API and so can only pass/fail, not take any other actions such as adding comments.

If that is correct then such checks will always fail for PRs submitted from a fork by a non-team-member, and such PRs will therefore be perpetually blocked from merging.

To Reproduce

1. Use a GitHub account which does not have any special access to the google/blockly repository.
2. Fork google/blockly.
3. Create and submit a PR against google/blockly
4. See that the "Assign requested reviewers / requested-reviewer" and "Check clang format / clang-formatter (pull_request)" checks fail.

Expected behaviour

This is the expected behaviour, apparently.

Given that it appears that GitHub does not intend to provide a way to get checks such as these to work (given that this has been a known issue for ~2 years), I propose that an alternative approach be found. For instance:

• Some kind of bot / cron job could be run to update PR assignments periodically, using an API token with suitable privileges.
• The clang check could just fail without trying to add a comment to the PR.

Stack Traces

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/actions/github-script/v5/dist/index.js:4614:21
    at processTicksAndRejections (internal/process/task_queues.js:93:5) {
  name: 'HttpError',
  status: 403,
  response: {
    url: 'https://api.github.com/repos/google/blockly/issues/5656/assignees',
    status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset',
Error: Unhandled error: HttpError: Resource not accessible by integration
      connection: 'close',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Mon, 01 Nov 2021 16:35:13 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'GitHub.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-media-type': 'github.v3',
      'x-github-request-id': '0400:75C7:3A0B11:CD4CF1:61801741',
      'x-ratelimit-limit': '15000',
      'x-ratelimit-remaining': '14998',
      'x-ratelimit-reset': '1635788111',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '2',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Resource not accessible by integration',
      documentation_url: 'https://docs.github.com/rest/reference/issues#add-assignees-to-an-issue'
    }
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/google/blockly/issues/5656/assignees',
    headers: {
      accept: 'application/vnd.github.-preview+json',
      'user-agent': 'actions/github-script octokit-core.js/3.5.1 Node.js/12.13.1 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"assignees":["cpcallen"]}',
    request: { agent: [Agent], hook: [Function: bound bound register] }
  }
}

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/actions/github-script/v5/dist/index.js:4614:21
    at processTicksAndRejections (internal/process/task_queues.js:93:5) {
  name: 'HttpError',
  status: 403,
  response: {
    url: 'https://api.github.com/repos/google/blockly/issues/5656/comments',
    status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset',
      connection: 'close',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Mon, 01 Nov 2021 17:16:56 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'GitHub.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-media-type': 'github.v3',
      'x-github-request-id': '0400:6B18:198B47:FF8956:61802107',
      'x-ratelimit-limit': '15000',
      'x-ratelimit-remaining': '14992',
      'x-ratelimit-reset': '1635788111',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '8',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Resource not accessible by integration',
      documentation_url: 'https://docs.github.com/rest/reference/issues#create-an-issue-comment'
    }
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/google/blockly/issues/5656/comments',
    headers: {
      accept: 'application/vnd.github.-preview+json',
      'user-agent': 'actions/github-script octokit-core.js/3.5.1 Node.js/12.13.1 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"body":"It looks like some of your files have not been formatted properly. Please run `npm run format`."}',
    request: { agent: [Agent], hook: [Function: bound bound register] }
  }
}
Error: Unhandled error: HttpError: Resource not accessible by integration

[cpcallen]

Ah, @rachel-fenichel remembered that this can be caused by specifying on: pull_request instead of on: pull_request_target, and provided a link to relevant documentation.

[cpcallen]

Update: in PR #5661 (pulling from rachel-fenichel:generators_const_let_javascript) the "Assign requested reviewers / requested-reviewer" check failed, despite (I presume!) @rachel-fenichel having commit access to this (google/blockly) repository. So apparently not even being a project contributor is sufficient to guarantee the requisite perms when pulling from a fork.

(I note that PR #5660, pulling from fraser-plus-plus in this repo, succeeds as expected.)

[cpcallen]

To do:

• chore: Fix permissions for Assign requested reviewers workflow #5666
• fix: Don't crash when unable to post comment to PR #5669
• #???? (to create report_clang_format)