← Void · A-to-Mind · Fix an automation

GitHub Actions "Resource not accessible by integration" (403): give the token the permission it needs

You see: 403 · Resource not accessible by integration

What it means

The GITHUB_TOKEN your workflow runs with does not have the permission the step needs. Its permissions start from the repository or organization default (often read-only) and are then set by the permissions key in the workflow. Writing to a different repository is outside what that token can ever do.

How to fix it

1. Find the step that failed and what it tried to do: comment on a pull request, push, create a release, label an issue.
2. Add a permissions block to that job granting just that, for example permissions: with pull-requests: write, or contents: write. Scopes you leave out drop to none.
3. If the run comes from a fork's pull request or Dependabot, the token is read-only by design; move the write into a workflow that runs on the base repository.
4. If it writes to another repository, use a GitHub App installation token or a personal access token stored as a secret instead of GITHUB_TOKEN.

If it keeps coming back

An admin can change the default in the repository's Settings, Actions, General, Workflow permissions; setting permissions per job in the workflow is the safer habit.

The One-Time Fix covers one workflow. What you send and what you get back.

Sources

• Controlling permissions for GITHUB_TOKEN (GitHub Docs)
• Managing GitHub Actions settings for a repository (GitHub Docs)