HttpError: Resource not accessible by integration

[NaffanDroo]

Hi, up until the last few days v3 was working fine and then the below error started. I tried v3.1 too but get the same.

Has something changed that the action relies on?

‘’’
HttpError: Resource not accessible by integration
at /home/runner/work/_actions/orgoro/coverage/v3.1/webpack:/typescript-action/node_modules/@octokit/request/dist-node/index.js:86:1
at processTicksAndRejections (node:internal/process/task_queues:96:5)
‘’’

[DannyBruno]

We are also seeing this. Thought at first it was an issue on our end, but I have confirmed paths are correct and token has R/W permissions. Any ideas?

[kolok]

Same same

[fabienheureux]

You can check the permission set on your GITHUB_TOKEN variable by checking the Set up step in your workflow run.

Here for example https://github.com/MTES-MCT/apilos/actions/runs/5398219719/jobs/9896520270 you can see that it has read only permissions

These permissions can be forced on a per-workflow basis following this documentation https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions

---

Note : this is the default for actions ran by Dependabot

By default, GitHub Actions workflows triggered by Dependabot get a GITHUB_TOKEN with read-only permissions. You can use the permissions key in your workflow to increase the access for the token:

[HebaruSan]

@fabienheureux do you know which permissions are required to make this Action work? I tried searching GitHub to see how other folks were using this Action, but this didn't work:

    permissions:
      contents: read
      pull-requests: write

[fabienheureux]

In my case, permissions below were enough

permissions:
   pull-requests: write

as seen in this PR https://github.com/MTES-MCT/apilos/pull/854/files

[NaffanDroo]

This works for me tidiness/tidy-python#111

[larinam]

For some reason the

permissions:
   pull-requests: write

doesn't fix the issue for us.
https://github.com/arc53/DocsGPT/actions/runs/5925817289/job/16065989742?pr=306

Any ideas?

[kojiromike]

@larinam I think you may need contents: read as well

[techman83]

For those stumbling across this issue, it's likely when this is run via a fork, rather then a branch in the same repo. There are security implications for allowing a checkout of code from a fork to have permissions.

See -> https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

To do safely, it likely requires two workflows. A workflow to generate the coverage, and one to process/add to the pr.