Unhandled error: HttpError: Resource not accessible by integration

[buzzwick]

New error when running Create Release action. PAT GHTOKENWORKFLOW was updated three days ago as a Classic PAT. Result is the same whether or not we check the option to use the GHTOKENWORKFLOW secret.

Run actions/github-script@v6
with:
github-token: ***
script: var bodyMD = process.env.bodyMD
const createReleaseResponse = await github.rest.repos.createRelease({
owner: context.repo.owner,
repo: context.repo.repo,
tag_name: '22.2.48',
name: 'current',
body: bodyMD.replaceAll('\n','\n').replaceAll('%0A','\n').replaceAll('%0D','\n').replaceAll('%25','%'),
draft: false,
prerelease: false,
make_latest: 'legacy',
target_commitish: 'ab48d1db82846cc645ab6bbdddbeb51a65e786fe'
});
const {
data: { id: releaseId, html_url: htmlUrl, upload_url: uploadUrl }
} = createReleaseResponse;
core.setOutput('releaseId', releaseId);

debug: false
user-agent: actions/github-script
result-encoding: json
retries: 0
retry-exempt-status-codes: 400,401,40[3](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:3),[4](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:4)04,422

env:
ALGoOrgSettings: {"doNotPublishApps":true,"artifact":"https://bcartifacts.azureedge.net/sandbox/22.0.[5](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:5)4157.55210/us"}

ALGoRepoSettings: 
BcContainerHelperPath: C:\ProgramData\BcContainerHelper\[6](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:6).0.0\BcContainerHelper\BcContainerHelper.ps1
repoName: Precious-Metals-Solution
templateUrl: https://github.com/microsoft/AL-Go-AppSource@main
Settings: {"keyVaultCertificateUrlSecretName":"","microsoftTelemetryConnectionString":"InstrumentationKey=84bd9223-6[7](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:7)d4-437[8](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:8)-85[9](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:9)0-9e4a46023be2;IngestionEndpoint=https://westeurope-1.in.applicationinsights.azure.com/","type":"AppSource App","sendExtendedTelemetryToMicrosoft":false,"appBuild":21,"installTestApps":[],"versioningStrategy":16,"installApps":[],"installTestLibraries":false,"runNumberOffset":0,"codeSignCertificatePasswordSecretName":"codeSignCertificatePassword","DeployToJMUAT":{"EnvironmentName":"UAT"},"country":"us","JMSANDBOX_AuthContextSecretName":"JMUAT_AUTHCONTEXT","partnerTelemetryConnectionString":"","doNotRunTests":false,"runs-on":"windows-latest","configPackages":[],"generateDependencyArtifact":false,"excludeEnvironments":[],"keyVaultCertificatePasswordSecretName":"","rulesetFile":"","licenseFileUrlSecretName":"licenseFileUrl","enableExternalRulesets":false,"memoryLimit":"","WGSDEMO_AuthContextSecretName":"WGS_AUTHCONTEXT","testFolders":[],"githubRunner":"windows-latest","doNotBuildTests":false,"environments":[],"companyName":"","assignPremiumPlan":false,"artifact":"https://bcartifacts.azureedge.net/sandbox/22.0.54157.552[10](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:10)/us","ghTokenWorkflowSecretName":"ghTokenWorkflow","enableTaskScheduler":false,"RMUAT_AuthContextSecretName":"RM_AUTHCONTEXT","enableCodeCop":false,"DeployToJMDEV":{"EnvironmentName":"DEV"},"repoVersion":"22.3","doNotPublishApps":true,"doNotSignApps":false,"JMDEMO_AuthContextSecretName":"JMUAT_AUTHCONTEXT","unusedALGoSystemFiles":[],"githubRunnerShell":"powershell","WRDEMO_AuthContextSecretName":"WR_AUTHCONTEXT","cacheKeepDays":3,"alwaysBuildAllProjects":false,"bcptTestFolders":[],"updateDependencies":false,"cacheImageName":"my","DeployToJMSANDBOX":{"EnvironmentName":"Sandbox"},"treatTestFailuresAsWarnings":false,"additionalCountries":[],"DeployToWGSDEMO":{"EnvironmentName":"DEMO","SyncMode":"ForceSync"},"enableUICop":false,"customCodeCops":[],"appDependencies":[],"JMUAT_AuthContextSecretName":"JMUAT_AUTHCONTEXT","doNotRunBcptTests":false,"DeployToJMDEMO":{"EnvironmentName":"Sandbox"},"appDependencyProbingPaths":[],"useCompilerFolder":false,"installTestFramework":false,"keyVaultCodesignCertificateName":"","installOnlyReferencedApps":true,"obsoleteTagMinAllowedMajorMinor":"","applicationDependency":"18.0.0.0","applicationInsightsConnectionStringSecretName":"applicationInsightsConnectionString","shell":"powershell","DeployToRMUAT":{"EnvironmentName":"UAT"},"keyVaultName":"","failOn":"error","DeployToELEMET_DEMO":{"EnvironmentName":"DEMO"},"templateUrl":"https://github.com/microsoft/AL-Go-AppSource@main","ELEMET_DEMO_AuthContextSecretName":"ELEMET_AUTHCONTEXT","JMDEV_AuthContextSecretName":"JMUAT_AUTHCONTEXT","DeployToRMDEMO":{"EnvironmentName":"DEMO"},"projectName":".","testDependencies":[],"appRevision":0,"codeSignCertificateUrlSecretName":"codeSignCertificateUrl","vsixFile":"","useProjectDependencies":false,"appSourceCopMandatoryAffixes":["CAI"],"buildModes":[],"templateBranch":"","installPerformanceToolkit":false,"PullRequestTrigger":"pull_request_target","keyVaultClientIdSecretName":"","appFolders":[],"repoName":"Precious-Metals-Solution","RMDEMO_AuthContextSecretName":"RM_AUTHCONTEXT","fullBuildPatterns":[],"DeployToWRDEMO":{"EnvironmentName":"DEMO"},"skipUpgrade":false,"projects":[],"installTestRunner":false,"adminCenterApiCredentialsSecretName":"adminCenterApiCredentials"}
bodyMD: ## What's Changed%0A* Cd dev by @ChesterDan in https://github.com/CAI-Software-Inc/Precious-Metals-Solution/pull/7%0A* Fixed two errant 70K object IDs by @buzzwick in https://github.com/CAI-Software-Inc/Precious-Metals-Solution/pull/9%0A%0A%0A**Full Changelog**: https://github.com/CAI-Software-Inc/Precious-Metals-Solution/compare/22.2.47...22.2.48

RequestError [HttpError]: Resource not accessible by integration
Error: Unhandled error: HttpError: Resource not accessible by integration
at D:\a_actions\actions\github-script\v6\dist\index.js:6842:21
at processTicksAndRejections (node:internal/process/task_queues:96:5)
at async eval (eval at callAsyncFunction (D:\a_actions\actions\github-script\v6\dist\index.js:15143:16), :4:31)
at async main (D:\a_actions\actions\github-script\v6\dist\index.js:15236:20) {
status: 403,
response: {
url: 'https://api.github.com/repos/CAI-Software-Inc/Precious-Metals-Solution/releases',
status: 403,
headers: {
'access-control-allow-origin': '*',
'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
connection: 'close',
'content-encoding': 'gzip',
'content-security-policy': "default-src 'none'",
'content-type': 'application/json; charset=utf-8',
date: 'Thu, 09 Nov 2023 14:27:12 GMT',
'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
server: 'GitHub.com',
'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
'transfer-encoding': 'chunked',
vary: 'Accept-Encoding, Accept, X-Requested-With',
'x-accepted-github-permissions': 'contents=write; contents=write,workflows=write',
'x-content-type-options': 'nosniff',
'x-frame-options': 'deny',
'x-github-api-version-selected': '2022-11-28',
'x-github-media-type': 'github.v3; format=json',
'x-github-request-id': 'D869:5352:38B9B6E:73DB948:654CEC40',
'x-ratelimit-limit': '1000',
'x-ratelimit-remaining': '990',
'x-ratelimit-reset': '1699543208',
'x-ratelimit-resource': 'core',
'x-ratelimit-used': '10',
'x-xss-protection': '0'
},
data: {
message: 'Resource not accessible by integration',
documentation_url: 'https://docs.github.com/rest/releases/releases#create-a-release'
}
},
request: {
method: 'POST',
url: 'https://api.github.com/repos/CAI-Software-Inc/Precious-Metals-Solution/releases',
headers: {
accept: 'application/vnd.github.v3+json',
'user-agent': 'actions/github-script octokit-core.js/3.6.0 Node.js/16.20.2 (win32; x64)',
authorization: 'token [REDACTED]',
'content-type': 'application/json; charset=utf-8'
},
body: {"tag_name":"[22](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:22).2.48","name":"current","body":"## What's Changed\\n* Cd dev by @ChesterDan in https://github.com/CAI-Software-Inc/Precious-Metals-Solution/pull/7\\n* Fixed two errant 70K object IDs by @buzzwick in https://github.com/CAI-Software-Inc/Precious-Metals-Solution/pull/9\\n\\n\\n**Full Changelog**: https://github.com/CAI-Software-Inc/Precious-Metals-Solution/compare/22.2.47...22.2.48","draft":false,"prerelease":false,"make_latest":"legacy","target_commitish":"ab48d1db8[28](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:28)46cc6[45](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:46)ab6bbdddbeb[51](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:52)a[65](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:66)e[78](https://github.com/CAI-Software-Inc/Precious-Metals-Solution/actions/runs/6813147609/job/18527059956#step:9:79)6fe"},
request: { agent: [Agent], hook: [Function: bound bound register] }
}
}

[freddydk]

What permissions does the GhTokenWorkflow have?

[buzzwick]

"repo" and "workflow" are the only ones, as near as I can determine. Not sure there is a way to query a secret for its permissions. But these are the ones I remember selecting, no others.

[freddydk]

You can locate your token and click the name to see what it has permissions to, like:

You can also add permissions after creation and the token will get new permissions (without changing the value)

[buzzwick]

Confirmed: only repo and workflow. What others would be needed here?

[freddydk]

That should be sufficient.
When running Create Release - did you put a checkmark in this:

?

[buzzwick]

Yes. Tried it both ways, with and without. Direct commit and no direct commit.

[freddydk]

Can I try to run a few tests in the repo?

[buzzwick]

Absolutely.

[AskeHolst]

We have the exact same issue, tried the same things.
But so far it is only in one repo it fails - and I cannot see what the difference could be.

[freddydk]

@AskeHolst - you can also not run Create Release?

[AskeHolst]

Correct, I have one repo where Create Release fails, but I have run it in three other repo the last few days, the last one just now and they all work.
The difference I now found was that it fails when specifying a version to release, but a release of latest works.

[freddydk]

On @buzzwick's problem, I found this: https://github.com/orgs/community/discussions/60820
So I tried to disable GitHub Actions on the repo and re-enable GitHub actions - and then it works - so this one seems to be a GitHub problem.

@AskeHolst - your problem seems to be something else - you should create another issue with the content of the analyze artifacts job.

[buzzwick]

Thank you for clearing that error. Another trick learned. Okay to close.

[Henry4Mprise]

I was working myself through the workshop and ran into the same issue.
But when I replaced GITHUB_TOKEN with the GHTOKENWORKFLOW (this one contains a PAT), it sort of works. Only got an error on creating the release branch.
But my question is, is that thei intention to replace GITHUB_TOKEN with GHTOKENWORKFLOW. Or is there a more general setting where the two are linked. I haven't found it in the workshop so far.

[freddydk]

@Henry4Mprise - the intention is never that you would need to modify workflows yourself, but thanks for investigating - I came to the same conclusion.
In the latest AL-Go preview, when you select Use GhTokenWorkflow for PR/Commit we also use the GhTokenWorkflow for creating the release and as @Henry4Mprise says - this now works.
The release branch is something else if that problem persists, you should create a new issue.