Resource not accessible by integration

[Kalaiselvi84]

Select Topic Area

Question

Body

Hi Team,

I am working on a Github action workflows to label the PRs. I am using actions/github-script@v4 and repo-token: ${{ secrets.GITHUB_TOKEN }} in the script. The script is working fine in my forked repo but it is not working in the production branch and getting error - "Resource not accessible by integration"

Link to the Code
Build Log

I have tried so far to grant the permissions:

1. permissions:
   id-token: write
   contents: read
   pull-requests: write
   issues: write
   checks: write
   security-events: write

2. permissions: write-all

3. permissions: read-all|write-all

Log:

status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      connection: 'close',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Sat, 10 Jun 2023 01:51:23 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'GitHub.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3',
      'x-github-request-id': '0BC1:41BC:3D7F70C:7D86059:6483D71B',
      'x-ratelimit-limit': '1000',
      'x-ratelimit-remaining': '999',
      'x-ratelimit-reset': '1686365483',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '1',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Resource not accessible by integration',
      documentation_url: 'https://docs.github.com/rest/reference/issues#add-labels-to-an-issue'
    }
  },
}

Please let me know if any information is required.

Thanks!

[airtower-luna]

The problem is that your workflow is running for a pull_request event. For PRs from forks the GITHUB_TOKEN gets read-only permissions (so people can't make PRs to do malicious stuff in the target repository).

You might want to use the pull_request_target event. That one takes the workflow from the default branch and runs with full permissions. This also means that running any code from the PR would be dangerous, but just parsing the description and possibly adding a label should be fine. 🙂

[Kalaiselvi84]

Thanks for the response!🙂

I have added the pull_request_target event to my workflow, but the build for the Label PR has not started as expected. Test PR with pull_request_target for your reference. Please let me know if there is anything missing in the code

[airtower-luna]

As I mentioned above, pull_request_target takes the workflow from the default branch. The workflow won't run until it's on the default branch.

[Kalaiselvi84]

I appreciate your help!😀 The script is able to successfully tag the pull request with the correct label in the default branch.

[Kalaiselvi84]

Hi @airtower-luna,

I have a quick question regarding the Github token. Is it safe to not use repo-token: ${{ secrets.GITHUB_TOKEN }} in the script for an open source project(Agones) since the secrets.GITHUB_TOKEN is automatically available to all workflows running in the repository, and it does not need to be explicitly defined or stored in the repository's secrets as per the documentation?

This is to avoid the below warning,

Warning: Unexpected input(s) 'repo-token', valid inputs are ['script', 'github-token', 'debug', 'user-agent', 'previews', 'result-encoding']

[airtower-luna]

actions/github-script will use the GITHUB_TOKEN by default, so there's no need to provide it. If it's safe depends on the content of your script (which seems to be okay at a glance).