使用CURL触发GitHub Workflow失败的原因排查

已创建GitHub Actions工作流和细粒度个人访问令牌（fine-grained PAT），尝试通过CURL请求触发工作流，但工作流未启动。CURL返回204状态码，PAT仅配置了Contents的「读和写」权限。以下是相关信息及排查分析：

工作流代码 #

name: Dispatch Test

on:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Parse payload
        run: |
          echo "Received payload: ${{ github.event.client_payload | tojson }}"
          
          # Access specific keys in the payload
          key1_value=$(echo "${{ github.event.client_payload.key1 }}")
          key2_value=$(echo "${{ github.event.client_payload.key2 }}")

          echo "Value of key1: $key1_value"
          echo "Value of key2: $key2_value"

CURL请求命令 #

curl -X POST \
  -H "Accept: application/vnd.github.everest-preview+json" \
  -H "Authorization: Bearer github_pat_PERSONAL_ACCESS_TOKEN" \
  --data '{"event_type": "trigger-curl-event", "client_payload": {"key1": "value1", "key2": "value2"}}' \
  https://api.github.com/repos/USER/PROJECT/dispatches

完整CURL请求日志 #

curl -v -X POST \
  -H "Accept: application/vnd.github.everest-preview+json" \
  -H "Authorization: Bearer github_pat_XXX" \
  --data '{"event_type": "trigger-curl-event", "client_payload": {"key1": "value1", "key2": "value2"}}' \
  https://api.github.com/repos/USER/PROJECT/dispatches

Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 4.208.26.200:443...
* Connected to api.github.com (4.208.26.200) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=GitHub, Inc.; CN=*.github.com
*  start date: Feb 16 00:00:00 2023 GMT
*  expire date: Mar 15 23:59:59 2024 GMT
*  subjectAltName: host "api.github.com" matched cert's "*.github.com"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* Using Stream ID: 1 (easy handle 0x56495c8ac830)
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> POST /repos/deltaboukensha/db-chatgpt-sambla/dispatches HTTP/2
> Host: api.github.com
> user-agent: curl/7.81.0
> accept: application/vnd.github.everest-preview+json
> authorization: Bearer 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
> content-length: 92
> content-type: application/x-www-form-urlencoded
> 
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* We are completely uploaded and fine
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
< HTTP/2 204 
< server: GitHub.com
< date: Fri, 01 Mar 2024 13:33:35 GMT
< github-authentication-token-expiration: 2024-03-31 13:37:43 +0200
< x-github-media-type: github.v3; param=everest-preview; format=json
< x-accepted-github-permissions: contents=write
< x-github-api-version-selected: 2022-11-28
< x-ratelimit-limit: 5000
< x-ratelimit-remaining: 4999
< x-ratelimit-reset: 1709303615
< x-ratelimit-used: 1
< x-ratelimit-resource: core
< access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< access-control-allow-origin: *
< strict-transport-security: max-age=31536000; includeSubdomains; preload
< x-frame-options: deny
< x-content-type-options: nosniff
< x-xss-protection: 0
< referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
< content-security-policy: default-src 'none'
< vary: Accept-Encoding, Accept, X-Requested-With
< x-github-request-id: 9D80:B3C54:2B68CFA:2C501E6:65E1D92F
< 
* Connection #0 to host api.github.com left intact

未触发原因排查及解决 #

1. 事件类型不匹配 #

工作流监听的是workflow_dispatch事件，但CURL请求调用的是repository_dispatch API（路径为/dispatches）并指定了event_type: trigger-curl-event。这是两种完全不同的触发机制：

• workflow_dispatch需通过GitHub UI或专属的workflow_dispatch API触发，不需要event_type参数
• repository_dispatch要求工作流监听对应的事件类型才能触发

解决方法：
修改工作流的触发条件，改为监听repository_dispatch并匹配请求中的事件类型：

on:
  repository_dispatch:
    types: [trigger-curl-event]

2. PAT权限不足 #

当前PAT仅配置了Contents的读写权限，但触发repository_dispatch需要**「Actions」权限下的「读和写」**，而非Contents权限。从日志的x-accepted-github-permissions: contents=write可确认，请求仅获得了contents写入权限，缺少Actions相关权限。

解决方法：
重新生成细粒度PAT，在权限配置中找到「Actions」选项，设置为「读和写」，然后替换CURL命令中的令牌。

3. 请求内容类型不规范（次要） #

日志显示请求的content-type为application/x-www-form-urlencoded，但GitHub API期望接收application/json格式的请求。虽然204状态码表明请求已被接收，但显式指定正确的Content-Type可避免潜在问题：
修改CURL命令，添加-H "Content-Type: application/json"：

curl -X POST \
  -H "Accept: application/vnd.github.everest-preview+json" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer github_pat_PERSONAL_ACCESS_TOKEN" \
  --data '{"event_type": "trigger-curl-event", "client_payload": {"key1": "value1", "key2": "value2"}}' \
  https://api.github.com/repos/USER/PROJECT/dispatches

内容的提问来源于stack exchange，提问作者Delta Boukensha