GitHub Community
Resource not accessible by integration when using Github App token #69154
Select Topic AreaBug BodyHi, I am trying to create a When running the workflow I get the error Permission screenshot
App settings page
Workflow filename: Update docs
on:
workflow_dispatch:
gollum:
jobs:
docs:
runs-on: arc-runner-k8s
permissions:
contents: write
steps:
- name: Generate a token
id: generate_token
uses: actions/create-github-app-token@v1
with:
app_id: ${{ secrets.APP_ID }}
private_key: ${{ secrets.APP_PEM }}
- name: Install curl
run: |
sudo apt update
sudo apt install curl -y
- name: Trigger the action
run: |
curl -L \
-X POST \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer ${{ steps.generate_token.outputs.token }}" \
-H "X-GitHub-Api-Version: 2022-11-28" \
https://api.github.com/repos/unipoll/gollum-test/dispatches \
-d '{"event_type":"update_submodules"}' |
Replies: 4 comments 5 replies
|
The error message "Resource not accessible by integration" typically occurs when the GitHub App token does not have the necessary permissions to access the requested resource. In your case, you are trying to create a repository_dispatch event using a GitHub App token for an organization. The error suggests that the token does not have the required permissions to access the repository or perform the requested action. To resolve this issue, you need to ensure that the GitHub App has the appropriate permissions and access to the repository. Here are a few steps you can follow: Verify GitHub App permissions: Additionally, the error message you received suggests that the resource you are trying to access is not found. Make sure to double-check the repository name and API endpoint in your curl command. The https://api.github.com/repos/unipoll/gollum-test/dispatches endpoint you provided should be valid if the repository exists, but it's worth confirming the repository name and organization. |
|
Hi, @glauccoslima, thank you for the reply
As you can see from the screenshots, I have the correct permissions. Permission screenshot
App settings page
As the permissions are set for all repositories(as you can see in the screenshot, this should also apply)
I am not sure about this one. Can you please elaborate? How can I check if it has access to the organization? I have the application installed in the organization(please see the screenshot bellow) Organization Apps page
Per this documentation, I only need to set repository permissions. Do I also need to add some organization permissions? One thing I am also confused is the clients secretes(please see the screenshot bellow).
In the documentation they say that I need an authentication token to make request(which is what I do in the workflow), but as you can see on the screenshot, it says
So, do I also need a client secrete? Lastly,
This would result in Thank you anyway, just trying to put it all together. |
|
Okay, I figured it out. I tried manually generating a JWT token and then using it to generate app installation token, and managed to trigger a repository. (Guess this is a good way to check the app permissions) As always, I missed a small detail which caused all the trouble. The actions/create-github-app-token by default only generates a token for the current repository. To generate a token for all repositories it's important to specify owner, i.e. steps:
- name: Generate a token
id: generate_token
uses: actions/create-github-app-token@v1
with:
app_id: ${{ secrets.APP_ID }}
private_key: ${{ secrets.APP_PEM }}
# Set the owner, so the token can be used in all repositories
owner: ${{ github.repository_owner }}@glauccoslima, thank you for the help, your reply might be useful for other people ! |
|
@mike-pisman I was using terraform to create a github repository using the github appauth. Although I'm passing the values for App_id, installtion_ID and possibly correct PEM file content to "pem_file" variable. I'm getting Resource not accessible by integration error. |
|
@hkonala, there is nothing special to storing PEM as a secret. Please refer to the documentation, step 3:
Basically, once you generate the app key, create a secrete and copy the certificate, everything beetween As to "Resource not accessible by integration error", it's related to permissions. Make sure your app has appropriate permissions in the organization/repository. |
|
@mike-pisman |
|
I am also not sure if the GH app defined at enterprise level and installed on two of its orgs will be able to generate the token for the enterprise. I was trying to create a token in the workflow by defining the owner as enterprise app I am encountering issues like "Failed to create token for "xxx" (attempt 1): Not Found - https://docs.github.com/rest/apps/apps#get-a-user-installation-for-the-authenticated-app" |
|
@SAIKARTHIKGOTURI, sorry I didn't see your message and it's been awhile. Have you resolved your problem? Looks like I ended up switching to This workflow(Update docs) runs in the project repo. When I update github wiki pages(gollum trigger), it will generate token for authentication/authorization and, using name: Update docs
on:
workflow_dispatch:
gollum:
workflow_run:
workflows: ["Update API Changelog"]
branches: [main]
types:
- completed
jobs:
docs:
runs-on: arc-runner-k8s
permissions: write-all
steps:
- name: Generate a token
id: generate_token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PEM }}
owner: ${{ github.repository_owner }}
- name: Repository Dispatch
uses: peter-evans/repository-dispatch@v2
with:
token: ${{ steps.generate_token.outputs.token }}
repository: unipoll/docs
event-type: update_submodulesThis one is triggered by previous workflow and checks out main repo wiki pages as sub-module. name: Update submodules
on:
workflow_dispatch:
repository_dispatch:
types: [update_submodules]
jobs:
update_submodules:
# runs-on: ubuntu-latest
runs-on: arc-runner-k8s
permissions:
contents: write
pull-requests: write
steps:
- name: Force update git
run: |
sudo apt-get update
sudo apt-get install -y software-properties-common
sudo add-apt-repository -y ppa:git-core/ppa
sudo apt-get update
sudo apt-get install -y git
- uses: actions/checkout@v4
with:
token: ${{ secrets.GITHUB_TOKEN }}
submodules: true
- name: Git Sumbodule Update
run: |
git pull --recurse-submodules
git submodule update --remote --recursive
- name: Commit update
run: |
git config --global user.name 'Bot'
git config --global user.email 'bot@noreply.github.com'
git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
git commit -am "Auto updated submodule references" && git push || echo "No changes to commit"I hope this helps, let me know if you have any other questions. This and other code lives in https://github.com/unipoll, feel free to check out other workflows |
|
If anyone is here after errors when running Tauri Actions: The actual solution for me was simple: I had created a git tag locally that was ahead of my remote main branch. The tauri-action was trying to create a release for a commit that didn't exist on the remote repository. I spent hours debugging permissions, tokens, and workflow configurations for nothing 😅 Fix: Simply push your local main branch to origin before creating/pushing tags: git push origin main
git push origin v1.0.0 # or whatever your tag isThis ensures the commit that the tag points to actually exists on the remote repository when tauri-action tries to create the release. |
Okay, I figured it out. I tried manually generating a JWT token and then using it to generate app installation token, and managed to trigger a repository. (Guess this is a good way to check the app permissions)
As always, I missed a small detail which caused all the trouble. The actions/create-github-app-token by default only generates a token for the current repository. To generate a token for all repositories it's important to specify owner, i.e.
owner: ${{ github.repository_owner }}