digger
digger copied to clipboard
403 Resource not accessible by integration []
When a workflow run using AWS OIDC federation fails with:
error getting pull request: GET https://api.github.com/repos/octo-org/octo-repo/pulls/1/files: 403 Resource not accessible by integration []
we need to explicitly add pull-request: write
permissions:
as such:
permissions:
id-token: write
contents: read
+ pull-requests: write
—
Reference
Thanks for filing @almereyda ! we will look into this asap
We looked into it and it seems that the pull-requests: write
permission is required to post PR comments
permissions:
contents: write # required to merge PRs
id-token: write # required for workload-identity-federation
pull-requests: write # required to post PR comments
statuses: write # required to validate combined PR status
Also didn't fully understand the relation to OIDC - could you share a bit more detail @almereyda ?
Thank you for looking into this.
OIDC is used implicitly with aws-role-to-assume
.
The article linked in the OP references section described the same observed behaviour under very similar circumstances, using AWS "workload identity", and the fix helped.