Resource not accessible by integration

[yonas]

Run actions/create-github-app-token@v2
  with:
    app-id: 1383744
    private-key: ***
    owner: yonasBSD
    skip-token-revoke: false
    github-api-url: https://api.github.com/
  env:
    CARGO_TERM_COLOR: always
    PROJECT_NAME_UNDERSCORE: github-rs
    CARGO_INCREMENTAL: 0
    RUSTFLAGS: -Ccodegen-units=1 -Copt-level=0 -Clink-dead-code -Coverflow-checks=off -Zpanic_abort_tests -Cpanic=abort
    RUSTDOCFLAGS: -Cpanic=abort
    CARGO_HOME: /home/runner/.cargo
Input 'repositories' is not set. Creating token for all repositories owned by yonasBSD.

Run curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/user
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100   171  100   171    0     0   1023      0 --:--:-- --:--:-- --:--:--  1023
{
  "message": "Resource not accessible by integration",
  "documentation_url": "https://docs.github.com/rest/users/users#get-the-authenticated-user",
  "status": "403"
}

[gr2m]

Make sure the app is installed on the repository. If you changed permissions, you need to accept the changes for the installation, even if it's your own

[yonas]

@gr2m

Make sure the app is installed on the repository.

Yes, it shows up under https://github.com/yonasBSD/github-rs/settings/installations

If you changed permissions, you need to accept the changes for the installation, even if it's your own

I've accepted all the permission changes.

[gr2m]

Then I don't know I'm afraid. Are you sure you configured the correct github app?

Unless you can create a reproducible test case, we won't be able to help you out. It's most likely a configuration problem on your side.

[yonas]

Are you sure you configured the correct github app?

These are the app permissions:

Permissions

✅ Read access to actions, actions variables, administration, checks, issues, members, metadata, organization actions variables, organization secrets, and secrets
✅ Read and write access to code and pull requests

Repository access

All repositories
This applies to all current and future repositories owned by the resource owner. Also includes public repositories (read-only).

[gr2m]

Run curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/user

Apologies, I see the problem now.

The endpoint you are requesting is only usable with OAuth or user-to-server tokens:
https://api.github.com/user

See https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user

Try to get a repository instead to test the token:
https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#get-a-repository

[yonas]

Try to get a repository instead to test the token:
https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#get-a-repository

This works:

curl -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer $GITHUB_TOKEN" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/repos/yonasBSD/yazi

I'm going to try using a personal access token instead of GitHub apps.

[yonas]

It works with a personal access token. 👍

Close if you feel this is an acceptable solution.

[turbobobbytraykov]

I know that the issue is closed, but I recently struggled with the same situation and it's thanks to @gr2m 's comment earlier about consulting with Permissions required for GitHub Apps.
In my use case I wanted to trigger a respository_dispatch event and I was getting the same error: Resource not accessible by integration

Additionally, when checking the token issued by actions/create-github-app-tokenit was with the expected permissions, but that didn't matter.
The problem here is that there is no clear error and it's up to reading "moon logic" sentences in the very specific guide REST API endpoints for repositories - in my case:

The fine-grained token must have the following permission set:
"Contents" repository permissions (write)

The problem here is that neither the GitHub API endpoints, nor the action (the underlying mechanism, I am not blaming the action itself) can point out if there are specific permissions missing when the GitHub app is configured.

I am not sure, but may be adding a section to this action's README to consult with the API endpoint documentation on what permissions are needed, would be great. @gr2m , what do you think?