GITHUB_TOKEN gets 403 when posting PR comments on branch protected by ruleset despite pull-requests: write permission
#191524
Replies: 6 comments 3 replies
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
|
Yeah—this one looks like a permissions bug at first glance, but it’s actually GitHub being stricter than the docs make obvious. Let’s break it down cleanly. 🚨 What’s really happening Even though you set: permissions:
pull-requests: write
issues: writethe GitHub applies extra restrictions to automation tokens when:
👉 Result: That’s why:
🔥 The key hidden rule
And commenting via 🧠 Most likely root causes (ranked)1. Wrong event context (
|
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
Arfu |
Beta Was this translation helpful? Give feedback.
-
npx -y @tencent-weixin/openclaw-weixin-cli@latest install |
Beta Was this translation helpful? Give feedback.
-
|
في أحد، ٥ أبريل، ٢٠٢٦ في ٨:٥٤ ص، كتب mao19901987-lang <
***@***.***>:
… Arfu
npx -y @***@***.*** install
—
Reply to this email directly, view it on GitHub
<#191524 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/CAFAR6I2YDPJBRVSLMHMM3T4UHYJPAVCNFSM6AAAAACXMIOHMSVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMNBVGI3TCNY>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
🏷️ Discussion Type
Bug
💬 Feature/Topic Area
API
Body
Bug report
Summary
The
GITHUB_TOKENreturns a 403 error when trying to post a comment on a pull request targeting a protected branch (via a ruleset), even thoughpull-requests: writeis explicitly declared in the workflow permissions and the ruleset only restricts merging, not interactions.Steps to reproduce
pull_requestrule requiring 1 approving reviewpull-requests: writeandissues: writepermissions/repos/{owner}/{repo}/issues/{pr_number}/comments)Expected behavior
The
GITHUB_TOKENwithpull-requests: writeshould be able to post comments on a PR regardless of branch protection rules, since commenting is not a protected operation — only merging is.Actual behavior
Workarounds attempted
issues: writeandpull-requests: writeto the workflow job permissionsContext
super-linter/super-linterbut maybe reproducible with any workflow posting to the API endpointEnvironment
Beta Was this translation helpful? Give feedback.
All reactions