GitHub Actions: Resource not accessible by integration (HTTP 403)

Every workflow run gets a GITHUB_TOKEN. Its permissions come from the permissions: key, or from the repository default when the key is missing. When a step calls the GitHub API (through gh, actions/github-script or an action) with a scope the token does not have, the API answers 403 and the step fails with Resource not accessible by integration.

Fix: grant the scope the job needs

name: PR comment
on: pull_request

permissions:
  contents: read
  pull-requests: write      # needed to comment on or label pull requests

jobs:
  comment:
    runs-on: ubuntu-latest
    steps:
      - run: gh pr comment "$PR" --body "Thanks!"
        env:
          GH_TOKEN: ${{ github.token }}
          PR: ${{ github.event.pull_request.html_url }}

When you set permissions, every scope you do not list becomes none, so list contents: read too if the job checks out code.

Scopes for common tasks

Pull requests from forks

For pull_request events from forks, GITHUB_TOKEN is read-only and secrets are not available, whatever the workflow requests. This protects the repository from code in the pull request. If such runs must write (for example to post test results), split the work: run the tests on pull_request, then post the results from a workflow_run workflow that does not execute the PR's code.