[aw-failures] 3 runs failed with `Your account was suspended` 403 (2026-05-26 10:28–10:39 UTC)

[github-actions]

Problem

Between 2026-05-26 10:28 UTC and 10:39 UTC, three agentic-workflow runs in github/gh-aw failed at the GitHub-checkout / repo-permission-check step with the same identity error:

Warning: Repository permission check failed: Sorry. Your account was suspended - https://docs.github.com/rest
##[error]fatal: unable to access 'https://github.com/github/gh-aw/': The requested URL returned error: 403
The process '/usr/bin/git' failed with exit code 128

The 403 was raised before the agent ever started; the post-failure cleanup then failed with Cannot find module '/home/runner/work/_temp/gh-aw/actions/setup_globals.cjs' because the activation step had not yet populated _temp/gh-aw/actions/.

Affected Runs

Run	Workflow	Started (UTC)	Trigger
§26446905995	AI Moderator	10:28:55	issue_comment
§26447363137	Package Specification Extractor	10:39:07	schedule
§26447374892	Functional Pragmatist	10:39:24	schedule

Different workflows, different triggers — but the same 403 disposition, so the suspended identity is shared. The 11-minute window plus the fact that subsequent runs succeeded points to a transient suspension or token revocation.

Probable Root Cause

A GitHub App installation token or bot account used by gh-aw's checkout step was suspended for ~11 minutes. Candidates:

1. A GitHub App used by gh-aw (e.g., for app-token minting) was rate-limited or temporarily suspended.
2. A bot account whose PAT is configured as a workflow secret was suspended.
3. The agentic-workflows-app (or equivalent) installation in github/gh-aw was briefly disabled.

Unknown: whether this was a github/gh-aw-specific event or a broader GitHub-side incident.

Evidence (Log Excerpt — run §26446905995)

Full error context

2026-05-26T10:41:03.9163955Z ##[warning]Repository permission check failed: Sorry. Your account was suspended - https://docs.github.com/rest
2026-05-26T10:41:03.9176907Z ##[warning]⚠️ Repository permission check failed: Sorry. Your account was suspended - https://docs.github.com/rest
...
2026-05-26T10:42:01.2065615Z ##[error]fatal: unable to access 'https://github.com/github/gh-aw/': The requested URL returned error: 403
2026-05-26T10:42:01.2073943Z The process '/usr/bin/git' failed with exit code 128
2026-05-26T10:42:16.7978174Z ##[error]fatal: unable to access 'https://github.com/github/gh-aw/': The requested URL returned error: 403
2026-05-26T10:42:16.7996275Z The process '/usr/bin/git' failed with exit code 128
2026-05-26T10:42:31.8815925Z ##[error]fatal: unable to access 'https://github.com/github/gh-aw/': The requested URL returned error: 403
2026-05-26T10:42:32.0004095Z ##[error]The process '/usr/bin/git' failed with exit code 128

Proposed Remediation

1. Identify the suspended principal. Cross-reference the failing runs' OIDC subject / app installation ID against repository app installation logs to determine which identity was suspended.
2. Improve diagnostic. The current pre-activation warning is logged but the failure surfaces three steps later as a generic git 128. Surface the upstream warning into the failure-issue body so the next human triager sees account suspended immediately.
3. Resilient cleanup. Three runs additionally crashed in the failure-handler path with Cannot find module 'setup_globals.cjs' because the pre-activation download did not complete. The conclusion step should not require artifacts the activation step is responsible for creating; it should fail-soft when those are missing.

Success Criteria

• The suspended principal is identified and the 11-minute outage explained (post-mortem comment on this issue is sufficient).
• The failure-handler path produces a usable failure-issue body even when activation never populated _temp/gh-aw/actions/ — no Cannot find module 'setup_globals.cjs' traceback.
• (Optional) The pre-activation Repository permission check failed warning is surfaced in the auto-generated [aw] <workflow> failed issue body when present.

Verification

• After fixes: simulate an account-suspended-style 403 in a synthetic run (e.g., revoke the token mid-run via a test app) and confirm:
  • The failure-issue body contains the suspension warning text, not just exit code 128.
  • No Cannot find module 'setup_globals.cjs' error appears in the conclusion log.

References

• Parent: [aw-failures] Failure Investigator (6h) — 14 failures, 3 clusters (2026-05-26 08:00–14:00 UTC) #34938
• §26446905995 — AI Moderator
• §26447363137 — Package Specification Extractor
• §26447374892 — Functional Pragmatist
  Related to [aw-failures] Failure Investigator (6h) — 14 failures, 3 clusters (2026-05-26 08:00–14:00 UTC) #34938

Generated by 🔍 [aw] Failure Investigator (6h) · opus47 18.6M · ◷

• expires on Jun 2, 2026, 1:59 PM UTC