Trying to test add a label in a github action on an approve review, fails to add the label due to permissions

[davidradl]

I am using

on:
  pull_request_review:
jobs:
  PR-auto-approve:
    runs-on: ubuntu-latest
    permissions: write-all
    #environment: mine
    steps:
      - uses: actions/github-script@v5
        with:
            #github-token: ${{ secrets.MY_PAT }}
            script: |
            
               if ( context.payload.review.state == 'approved') {
                     github.rest.issues.addLabels({
                          issue_number: context.issue.number,
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          labels: ['David123']
                        });

I see error:

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/actions/github-script/v5/dist/index.js:4560:21
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {
  status: 403,
  response: {
    url: 'https://api.github.com/repos/davidradl/Git-action-test/issues/7/labels',
    status: 403,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Fri, 09 May 2025 16:06:48 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'github.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-accepted-github-permissions': 'issues=write; pull_requests=write',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3',
      'x-github-request-id': '1C41:2AB6EE:1B3096:366C6F:681E2818',
      'x-ratelimit-limit': '5000',
      'x-ratelimit-remaining': '4996',
      'x-ratelimit-reset': '17[46](https://github.com/davidradl/Git-action-test/actions/runs/14933010089/job/41953775189#step:2:47)807651',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '4',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Resource not accessible by integration',
      documentation_url: 'https://docs.github.com/rest/issues/labels#add-labels-to-an-issue',
      status: '403'
    }
  },
  request: {
    method: 'POST',
    url: 'https://api.github.com/repos/davidradl/Git-action-test/issues/7/labels',
    headers: {
      accept: 'application/vnd.github.-preview+json',
      'user-agent': 'actions/github-script octokit-core.js/3.5.1 Node.js/20.19.0 (linux; x64)',
      authorization: 'token [REDACTED]',
      'content-type': 'application/json; charset=utf-8'
    },
    body: '{"labels":["David123"]}',
    request: { agent: [Agent], hook: [Function: bound bound register] }
  }
}
Error: Unhandled error: HttpError: Resource not accessible by integration

I notice a similar discussion around the PR request
#490

I am not sure whether the write permissions are ignored for pull_request_review as well - as the GITHUB TOKEN being used does not have permission to issue the call.

This is a PR that comes from a fork and is being reviewed.

I can add a label using the equivalent POST mentioned in the error using curl using my PAT. I tried adding my PAT as a secret in the repo and in an environment - but the secret PAT does not seem to be picked up and it says "Input required and not supplied: github-token".

[joshmgross]

This is a PR that comes from a fork and is being reviewed.

If the pull request is from a fork, the permissions on the Actions GITHUB_TOKEN. will be read only.

[joshmgross]

Is "review time" different from the time when a PR is opened?

[davidradl]

@joshmgross Yes I believe so, but ideally I would want to be able to list the PRs sorted by review time. I am not sure I can easily do that at the moment, maybe through graphql.

I am thinking that I

1. run a git action with

on:
  pull_request_review:

2. Checkout
3. Create a file with the PR number / time. This would be similar to running a build and then caching the results.
4. Either upload as an artifact or store in a cache.
5. Then have a second git action with write permission pick up the artifact or cache content and query collaborator roles and add labels for any PR in the list. It may need to cache or store an artifact to track which times have been processed. The second gitaction would be run like boring-cyborg, but I was thinking of implementing it in bash / github-script if I can get away with it.

WDYT?

[joshmgross]

That definitely sounds feasible, let me know how it goes!