Cache fails for Pull Request re-runs with "No scopes with read permission were found on the request."

In pull requests we often get:

[warning]No scopes with read permission were found on the request.

And the build runs without cache.

Please note that I’m talking about pull request build triggered when pushing a commit (or opening the PR). So this issue is not explained by #129.

[joshmgross]

👋 Hey all, thank you for your patience. Pull Request re-runs should now have the correct GitHub Ref and work with this action.

[joshmgross]

👋 Hey all, we’re working on this issue but it will require fixes internally to fix the GitHub ref for pull request re-runs.

For some background, every cache has a “scope” (see Docs: Matching a Cache Key which is determined by the GitHub ref of the current event that triggered the workflow run (as well as the event type itself).

The scope is encoded in the JWT token used by the action to authenticate to the internal cache service. The scope is used to determine which caches we can read and write to and is intended to prevent any potential security issues. For example, you wouldn’t want a pull request from a fork to be able to write to the cache on the default branch.

The logic that determines what scopes to give the token also validates that the ref of the pull request is valid (refs/pulls/*). When a pull request ref does not match that format, we don’t give any scopes to the token. This is why you see the error “No scopes with read permission were found on the request”.