`Error posting PR comment: Resource not accessible by integration: 403`

[csidirop]

describe your issue

While trying the commit-check action with the experimental pr-comments option I ran into an issue.

When using more or less the config example from the marketplace the workflow aborted. These are the lines from the log:

2025-09-11T13:53:02.4577894Z Request GET /repos/csidirop/actiontest/issues/1 failed with 403: Forbidden
2025-09-11T13:53:02.4580746Z Error posting PR comment: Resource not accessible by integration: 403 {"message": "Resource not accessible by integration", "documentation_url": "https://docs.github.com/rest/issues/issues#get-an-issue", "status": "403"}

Adding issues: write to the permissions fixes the issue. (See my commit-check.yml). I read that PR are treated like issues, but I don't know why pull-requests: write did not work. Maybe you can do something with that issue and info.

commit-check version

v1 ?

.commit-check.yml

name: Commit Check
on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  check:
    runs-on: ubuntu-latest
    permissions: # use permissions because use of pr-comments
        contents: read
        issues: write
        pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0 # required for merge-base check
      - uses: commit-check/commit-check-action@v1 # see https://github.com/marketplace/actions/commit-check-action
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with: # enable only what you need
          author-name: true
          author-email: true
          branch: false
          commit-signoff: false
          imperative: false
          job-summary: true
          message: false
          merge-base: false
          pr-comments: ${{ github.event_name == 'pull_request' }}

[shenxianpeng]

Hi @csidirop are you working on a fork repo? pr-comments does not work for a fork repo for now. see #77

[csidirop]

Hi, no it was non forked test repo with a PR from a branch part of that repo.

[shenxianpeng]

Hmm, interesting, you can see pre-comments just work for this PR #145 (comment)

And here is my YAML config

commit-check-action/.github/workflows/commit-check.yml

Lines 9 to 31 in 04667fa

	commit-check:
	runs-on: ubuntu-latest
	permissions: # use permissions because of use pr-comments
	contents: read
	pull-requests: write
	steps:
	- uses: actions/checkout@v5
	with:
	ref: ${{ github.event.pull_request.head.sha }} # checkout PR HEAD commit
	fetch-depth: 0 # fetch all history for all branches and tags
	- uses: ./ # self test
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # use GITHUB_TOKEN because of use pr-comments
	with:
	message: true
	branch: true
	author-name: true
	author-email: true
	commit-signoff: true
	merge-base: true
	imperative: true
	job-summary: true
	pr-comments: ${{ github.event_name == 'pull_request' }}

Maybe I need to create a test repo and try to reproduce this issue

[csidirop]

Hi, I had a bit of time this morning and did some more tests, but I got the same error every time.

However, I still think it's related to the issues permission endpoint. If you take a look at the docs you will find:
issues: Work with issues. For example, issues: write permits an action to add a comment to an issue. For more information, see [Permissions required for GitHub Apps](https://docs.github.com/en/rest/overview/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-issues).
and
pull-requests: Work with pull requests. For example, pull-requests: write permits an action to add a label to a pull request. For more information, see Permissions required for GitHub Apps.
I don't think either explanation is precise or (even) correct and in this case not really helpful. After a lot of digging I found the REST API Doc which states what I mentioned before:

Every pull request is an issue, [...] For this reason, "shared" actions for both features, like managing assignees, labels, and milestones, are provided within the Issues endpoints.

Which means: If we want to "add comment to an issue" (or PR! in this case) we need the issues: read/write permission.

In addition I checked the code, and if I understood correctly, the following line is using the issues endpoint:

commit-check-action/main.py

Line 132 in a7f1b1e

pull_request = repo.get_issue(int(pr_number))

Contrary to what I said before, the issues: read permission is sufficient to fix that error. There is no need for issues: write but it works anyway.

I hope this can help you a bit. Tell me if I can help out or do something else.

[shenxianpeng]

I used the following config, and the PR comment works. see #165 (comment). It works without adding issues: read.

commit-check-action/.github/workflows/commit-check.yml

Lines 9 to 27 in 6e021a9

	commit-check:
	runs-on: ubuntu-latest
	permissions: # use permissions because of use pr-comments
	contents: read
	pull-requests: write
	steps:
	- uses: actions/checkout@v5
	with:
	fetch-depth: 0 # Required for merge-base checks
	- uses: ./ # self test
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed for PR comments
	with:
	message: true
	branch: true
	author-name: true
	author-email: true
	job-summary: true
	pr-comments: ${{ github.event_name == 'pull_request' }}