GITHUB_TOKEN gets 403 "Resource not accessible by integration" merging a fork PR that the API itself reports as mergeable/clean

[KrisTHL181]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Workflow Configuration

Discussion Details

I run KrisTHL181/Break-This-Repo — a public repo — with a pull_request_target + scheduled workflow that auto-merges PRs via the REST merge endpoint. It merges dozens of PRs a day without trouble, including fork PRs and PRs of 50,000+ files. One specific PR (#517) has now failed on every attempt for hours with:

gh: Resource not accessible by integration (HTTP 403)

The call is:

permissions:
  pull-requests: write
  issues: write
  contents: write

gh api -X PUT "repos/$GITHUB_REPOSITORY/pulls/$pr/merge" \
  -f merge_method=merge -f sha="$HEAD_SHA"

The puzzling part: at the same moment this returns 403, GET /repos/KrisTHL181/Break-This-Repo/pulls/517 reports "mergeable": true, "mergeable_state": "clean", and the web UI shows a normal, working merge button. So GitHub agrees the PR can be merged — it just refuses this token.

The PR:

• head is a fork's default branch (main), cross-repository: yes; maintainer_can_modify: true
• 6,582 changed files, 158,910 additions, a single commit
• base repo is public, ~3 GB, ~207k files
• head commit was pushed ~3 min before the failing run and did not move afterwards

Already ruled out (each tested, not assumed):

• Branch protection / rulesets — /branches/main/protection → 404, /rulesets → []
• Merge method settings — merge, squash and rebase are all enabled
• Token permissions — the same workflow, same permissions:, successfully merges other PRs in the same run
• Conflicts — mergeable_state is clean; the code checks mergeable == CONFLICTING on a separate path
• Race with PR creation — the workflow fires ~4 s after the PR opens, but that is the norm for every PR here, and every other one merges
• The "PR is behind the base branch on a workflow file ⇒ needs workflows: write" explanation (the one GitHub Support describes): I reproduced that exact shape four ways — same-repo head, genuine fork head, fork-default-branch head, and a 6,500-file fork PR — and all four merged fine. So it does not explain this. (workflows also isn't an accepted key of the permissions: block, so GITHUB_TOKEN can't be granted it regardless.)
• Transient failure — three separate runs, including a scheduled one ~30 minutes later with the same head sha, returned the identical 403

Questions:

1. What condition makes PUT /pulls/{n}/merge answer 403 Resource not accessible by integration for a PR that reads as mergeable/clean?
2. Is there any supported way to merge such a PR using GITHUB_TOKEN (rather than a PAT or GitHub App installation token)?
3. Failing that, is there a supported way to detect this state before attempting the merge?

For what it's worth, the only thing I've ever seen clear it is pushing a new commit to the head branch — but that's from a single observation, so I can't claim it's causal.