Trying to test add a label in a github action on an approve review, fails to add the label due to permissions #598

davidradl · 2025-05-09T16:09:31Z

davidradl
May 9, 2025

I am using

on:
  pull_request_review:
jobs:
  PR-auto-approve:
    runs-on: ubuntu-latest
    permissions: write-all
    #environment: mine
    steps:
      - uses: actions/github-script@v5
        with:
            #github-token: ${{ secrets.MY_PAT }}
            script: |
            
               if ( context.payload.review.state == 'approved') {
                     github.rest.issues.addLabels({
                          issue_number: context.issue.number,
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          labels: ['David123']
                        });

I see error:

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/actions/github-script/v5/dist/index.js:4560:21
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {
  status: 403,
  response: {
    url: 'https://api.github.com/repos/davidradl/Git-action-test/issues/7/labels',
    status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Fri, 09 May 2025 16:06:48 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'github.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-accepted-github-permissions': 'issues=write; pull_requests=write',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3',
      'x-github-request-id': '1C41:2AB6EE:1B3096:366C6F:681E2818',
      'x-ratelimit-limit': '5000',
      'x-ratelimit-remaining': '4996',
      'x-ratelimit-reset': '17[46](https://github.com/davidradl/Git-action-test/actions/runs/14933010089/job/41953775189#step:2:47)807651',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '4',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Resource not accessible by integration',
      documentation_url: 'https://docs.github.com/rest/issues/labels#add-labels-to-an-issue',
      status: '403'
    }
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/davidradl/Git-action-test/issues/7/labels',
    headers: {
      accept: 'application/vnd.github.-preview+json',
      'user-agent': 'actions/github-script octokit-core.js/3.5.1 Node.js/20.19.0 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"labels":["David123"]}',
    request: { agent: [Agent], hook: [Function: bound bound register] }
  }
}
Error: Unhandled error: HttpError: Resource not accessible by integration

I notice a similar discussion around the PR request
#490

I am not sure whether the write permissions are ignored for pull_request_review as well - as the GITHUB TOKEN being used does not have permission to issue the call.

This is a PR that comes from a fork and is being reviewed.

I can add a label using the equivalent POST mentioned in the error using curl using my PAT. I tried adding my PAT as a secret in the repo and in an environment - but the secret PAT does not seem to be picked up and it says "Input required and not supplied: github-token".

joshmgross · 2025-05-16T16:19:09Z

joshmgross
May 16, 2025

This is a PR that comes from a fork and is being reviewed.

If the pull request is from a fork, the permissions on the Actions GITHUB_TOKEN. will be read only.

8 replies

joshmgross May 19, 2025

Is "review time" different from the time when a PR is opened?

davidradl May 23, 2025
Author

@joshmgross Yes I believe so, but ideally I would want to be able to list the PRs sorted by review time. I am not sure I can easily do that at the moment, maybe through graphql.

I am thinking that I

run a git action with

on:
  pull_request_review:

Checkout
Create a file with the PR number / time. This would be similar to running a build and then caching the results.
Either upload as an artifact or store in a cache.
Then have a second git action with write permission pick up the artifact or cache content and query collaborator roles and add labels for any PR in the list. It may need to cache or store an artifact to track which times have been processed. The second gitaction would be run like boring-cyborg, but I was thinking of implementing it in bash / github-script if I can get away with it.

WDYT?

joshmgross May 27, 2025

That definitely sounds feasible, let me know how it goes!

davidradl Jun 1, 2025
Author

Hi @joshmgross , unfortunately the cache in the above case gets written to refs/pull/7/merge. So is not in a branch, as such the cron github action does not have access to it!

I think the only way I can do this is to write a cron job that does a graphql for all open prs with reviews, we have less than 200 - as we use the stalebot to keep the numbers down. Then look into each PR and see whether a recent review has been done (within the cron period ish) and then process those to add the label.

I really wanted to use a trigger in some way to limit what we need to process, but it seems there is no way to do this currently with forked repos. If I am missing something, that would allow me to run with a triggered approach - that would be great to hear.

davidradl Jun 1, 2025
Author

I am going to see if artefacts have the same restrictions as the cache as well.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Trying to test add a label in a github action on an approve review, fails to add the label due to permissions #598

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 8 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Trying to test add a label in a github action on an approve review, fails to add the label due to permissions #598

Uh oh!

davidradl May 9, 2025

Replies: 1 comment · 8 replies

Uh oh!

joshmgross May 16, 2025

Uh oh!

joshmgross May 19, 2025

Uh oh!

davidradl May 23, 2025 Author

Uh oh!

joshmgross May 27, 2025

Uh oh!

davidradl Jun 1, 2025 Author

Uh oh!

davidradl Jun 1, 2025 Author

davidradl
May 9, 2025

Replies: 1 comment 8 replies

joshmgross
May 16, 2025

davidradl May 23, 2025
Author

davidradl Jun 1, 2025
Author

davidradl Jun 1, 2025
Author