Which permissions are required for gh pr checks?

[jaewonjo-gea]

Select Topic Area

Question

Body

I am currently working on a workflow that automatically makes a branch and push commits to it. I successfully created a PR, but I also want to monitor the checks on the created PR and merge the PR if all checks passed (or skipped).

When I try to run gh pr checks --watch and gh pr merge --merge --auto in a step using run:, I get the following error:

GraphQL: Resource not accessible by integration (node.statusCheckRollup.nodes.0.commit.statusCheckRollup.contexts.nodes.0.checkSuite.workflowRun)
Error: Process completed with exit code 1.

This is the code I wrote:

I added these permissions:

      id-token: write
      contents: read
      pull-requests: write
      statuses: read
      checks: read

(Note that this job was doing some other things as well, which required permissions such as pull-requests: write)

My guess is that there is an organization or repository level restriction on the permissions, but I could be doing something terribly wrong. I am also not on a fork.

Any thoughts?

[longlife1st]

@jaewonjo-gea
I had the same issue.
As far as I can see, adding actions: read fixes it.
As the error message implies that the CLI tries to access the workflowRun in the check suite, probably checking the action status is required.

[jsoref]

I think bugs and tickets should be opened against each and every entity related to this failure.

I'll start:

• Replace the API will return an error message that states the scopes or permissions your token needs github/docs#32105

There should be a ticket opened against:

• https://github.com/cli/cli/issues
• https://support.github.com/tickets/

But I don't have the energy to open them.