How to configure GitHub Action/App to allow PR creation, currently fails

[alexanderniebuhr]

Select Topic Area

Question

Body

I have the following setup:

a) officialorg/docs
b) myorg/docs (fork of officialorg/docs)
c) myorg/scripts

I do have a workflow in myorg/scripts, which generates a file, clones myorg/docs and pushes the file, now I want to create PR inside the same workflow. So the workflow in myorg/script should create a PR with myorg/docs as head and officialorg/docs.

I do have a GitHub App with the following permissions installed in myorg/scripts & myorg/docs. But it is not installed in officialorg/docs:

 Read access to administration, members, and metadata
 Read and write access to checks, code, commit statuses, and pull requests

I also have the following checkbox enabled in all repos:

However I don't get this to work. Please help?

* Request at 2024-05-10 22:00:52.149518919 +0000 UTC m=+0.402208896
* Request to https://api.github.com/graphql
> POST /graphql HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview
> Authorization: token ████████████████████
> Content-Length: 573
> Content-Type: application/json; charset=utf-8
> Graphql-Features: merge_queue
> Time-Zone: Etc/UTC
> User-Agent: GitHub CLI 2.48.0

GraphQL query:
mutation PullRequestCreate($input: CreatePullRequestInput!) {
      createPullRequest(input: $input) {
        pullRequest {
          id
          url
        }
      }
  }
GraphQL variables: {"input":{"baseRefName":"main","body":"This is an automated generated PR to update community content based on https://github.com/astrolicious/astro-tips.dev/pull/76","draft":false,"headRefName":"astrolicious/withastro-docs:astrotips-76","maintainerCanModify":true,"repositoryId":"MDEwOlJlcG9zaXRvcnkzNzczNzcxMjI=","title":"[astrotips] update community content"}}

< HTTP/2.0 200 OK
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< Content-Security-Policy: default-src 'none'
< Content-Type: application/json; charset=utf-8
< Date: Fri, 10 May 2024 22:00:52 GMT
< Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
< Server: GitHub.com
< Strict-Transport-Security: max-age=3[153](https://github.com/astrolicious/astro-tips.dev/actions/runs/9038525637/job/24839843384?pr=76#step:13:154)6000; includeSubdomains; preload
< Vary: Accept-Encoding, Accept, X-Requested-With
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Github-Media-Type: github.v4; param=merge-info-preview.nebula-preview; format=json
< X-Github-Request-Id: 7040:216478:2FA2241:5086BBD:663E9914
< X-Ratelimit-Limit: 5000
< X-Ratelimit-Remaining: 4979
< X-Ratelimit-Reset: 1715378592
< X-Ratelimit-Resource: graphql
< X-Ratelimit-Used: 21
< X-Xss-Protection: 0

{
  "data": {
    "createPullRequest": null
  },
  "errors": [
    {
      "type": "FORBIDDEN",
      "path": [
        "createPullRequest"
      ],
      "extensions": {
        "saml_failure": false
      },
      "locations": [
        {
          "line": 3,
          "column": 4
        }
      ],
      "message": "Resource not accessible by integration"
    }
  ],
  "extensions": {
    "warnings": [
      {
        "type": "DEPRECATION",
        "message": "The id MDEwOlJlcG9zaXRvcnkzNzczNzcxMjI= is deprecated. Update your cache to use the next_global_id from the data payload.",
        "data": {
          "legacy_global_id": "MDEwOlJlcG9zaXRvcnkzNzczNzcxMjI=",
          "next_global_id": "R_kgDOFn5RYg"
        },
        "link": "https://docs.github.com"
      }
    ]
  }
}

* Request took 109.57992ms
pull request create failed: GraphQL: Resource not accessible by integration (createPullRequest)

[MostlyKIGuess]

Are you also authorising the third party access that the workflow needs enough permission?
You can change this by going to security then applications and then find the app which does the workflow.

Also try reinstalling it in the officialorg , could be that it was just installed in your own repository.

[alexanderniebuhr]

It is not installed in the officialorg repository. Do I need to install the App in the officialorg or create a PAT for that too?
I though if I use a fork I don't need that, because as a user I can also create a PR without write permissions to that repository using GitHub or the CLI?

[MostlyKIGuess]

Yes,afaik I think forking just copies the source files, try installing it and check again

[MostlyKIGuess]

Does that answer it?