"Forbidden" (New issue)

[DaCHack]

Hi,

since a few weeks I receive a "Forbidden"-error in my Github action.
It worked flawlessly for years before. Updated the dockerhub-description version and updated the code to match the given example in the readme. Username and token I left unchanged since other parts of my action using the secret are working fine:
https://github.com/DaCHack/openvpn-docker/blob/master/.github/workflows/docker-hub.yml

Any idea what changed recently and how to adapt to that change?

        name: Docker Hub Description
        uses: peter-evans/dockerhub-description@v5
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
          repository:  ${{ secrets.DOCKER_HUB_USERNAME }}/openvpn

Thanks!

[peter-evans]

Hi @DaCHack

If the secret is fine then perhaps the repository name? I can see some whitespace before the name, maybe that is causing it. 🤔

        name: Docker Hub Description
        uses: peter-evans/dockerhub-description@v5
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
-         repository:  ${{ secrets.DOCKER_HUB_USERNAME }}/openvpn
+         repository: ${{ secrets.DOCKER_HUB_USERNAME }}/openvpn

[DaCHack]

Thanks. Removed that but still no luck.
I am totally puzzled why this comes up now without any changes applied by me.

[peter-evans]

I saw you had the action without a version specified, and somehow that was using v2 of the action, which is quite old now.

In v2 this is the API that was in use to "login":

dockerhub-description/src/dockerhub-helper.ts

Lines 14 to 18 in 616d1b6

	const response = await fetch('https://hub.docker.com/v2/users/login', {
	method: 'post',
	body: JSON.stringify(body),
	headers: {'Content-Type': 'application/json'}
	})

In more recent versions the API has been updated to a more modern method:

dockerhub-description/src/dockerhub-helper.ts

Lines 11 to 15 in 7579694

	const response = await fetch('https://hub.docker.com/v2/auth/token', {
	method: 'POST',
	body: JSON.stringify(body),
	headers: {'Content-Type': 'application/json'}
	})

I think the problem here is that originally the action allowed you to use your DockerHub password, but maybe that's not true anymore since updating to this new API. Perhaps the new API only accepts an access token.

Try logging into DockerHub and creating an access token with read/write/delete scope and use that instead of your password.

[DaCHack]

Thanks @peter-evans ! I was already working with a PAT since the beginning. Nonetheless, I Removed the PAT and created a new one. Still did not work and Throws the Forbidden error.

[DaCHack]

Sorry closed issue accentially!

Wanted to ask if using docker/login-action could be an issue?
All other actions in the job do Not Need any Login Data anymore since I do a Login Right in the beginning. Could it be that There is some Security mechanism on dockerhub-side that inhibits another login through this Action? If that Makes Sense, how can I Use the Action with the existing login?

[DaCHack]

The issue seems to arise at line 46 of Main.ts since the Statement before is still printed.

dockerhub-description/src/main.ts

Line 46 in 7579694

await dockerhubHelper.updateRepositoryDescription(

That means also that the Authentication Code does not fail. Just the application of the received token afterwards…?

[taylorific]

If it matters, I also started seeing this issue as well, recently, with no previous issues in dozens of builds running regularly for the past few years. But for some reason it's not happening updating the description on all my images. Still trying to narrow down the root cause.

I also tried to rotating/changing the DockerHub PAT and it didn't seem to help, same as what @DaCHack saw

[solthoth]

@taylorific One thing i noticed was that I get this error when my README.md exceeded a particular size. I was getting this same error at 6248 bytes (still below the 25000 documented). However, i was able to shrink it a bit (3262 bytes), and got a successful execution.

@peter-evans not sure if this info helps you on this.

[OidaTiftla]

I can see the same issue without modifying the PAT or version of the action recently. It also worked for a long time without any issues. But now it fails with the "FORBIDDEN" error. I also checked whether rotating the PAT helps, but it did not.

I can confirm that I updated the README.md since the last successful run and increased the size from 2147 chars to 2337 chars (in the latest revision (currently failing), in between I updated some of my test code and some pipelines failed because of my test code, but in the linked revision the test code was ok but the description update failed).

Adding a step to remove the development instructions from my README.md before pushing it to Docker Hub reduced the size of the README.md to 1992 chars. And now it works again: Updated revision

Hope this helps somehow debugging the problem. Nevertheless thank you for creating and maintaining the very helpful action!

[DaCHack]

That Sounds line it is Not authentication issue but some issue with the content of the Readme.md since other readme of mine work Fine Despite having more characters.

@peter-evans could You please add the other API outputs into the Error output?

dockerhub-description/src/dockerhub-helper.ts

Line 47 in cc30772

throw new Error(res.statusText)

According to the API it gives 3 different Data points back for a 401 error: errinfo, detail, message

I Hope with all 3 outputs provided in the output of our Workflow runs we could debug the issue.

Thanks!