[BUG] Auto-backport is failing: permission denied

[dblock]

Describe the bug

remote: Permission to opensearch-project/OpenSearch.git denied to github-actions[bot].

To Reproduce
Steps to reproduce the behavior:

1. Label an issue backport 1.x.
2. See failed job.

https://github.com/opensearch-project/OpenSearch/runs/4509880595?check_suite_focus=true

[dblock]

@VachaShah Do you know how to fix this?

[VachaShah]

Looks like github-actions does not have permissions to create PRs.

Error

remote: Permission to opensearch-project/OpenSearch.git denied to github-actions[bot].

I will look into it.

[VachaShah]

Tried the approach where in the workflow, we fork the repo and then create a branch to backport, cherry-pick the commit and create a PR from it. But the Github actions was not able to fork a repo, got error failed to fork: HTTP 403: Resource not accessible by integration while doing so.

[setiah]

@VachaShah try with a pre-created fork (say backport/OpenSearch) to which this backport GH has access, and use the checkout@v2 action to backport, push and raise PR from this backport fork. This would also help keep the permissions of this GH restricted to the backport fork alone and track the workflow retries better.

[VachaShah]

@setiah Wouldn't the pre-created fork have to belong to a user?

[VachaShah]

Update, the following things are needed to fix the permissions issue:

1. The token needs write permissions for pull requests and content in order to create pull requests on the repos. This is fixed in PR Fixing auto backport workflow #1845.
2. The GHA for backport creates branches (backport-<PR-number>-to-<release-branch>) to cherry-pick commits for backport. Hence, the branch permissions need to be defined for such branches. In order to better manage permissions, I have PRed the change to allow custom branch names in the GHA repo and use it in the OpenSearch repo. Details: Using custom branch name for auto backporting PRs #1862.

[VachaShah]

This issue is resolved and the backport workflow is able to create PRs. Example PR: #1959