Resource not accessible by integration

[serathius]

Description of the issue

Etcd CodeQL analysis is broken returning 403. etcd-io/etcd#13978

RequestError [HttpError]: Resource not accessible by integration
    at /home/runner/work/_actions/github/codeql-action/v1/node_modules/@octokit/request/dist-node/index.js:66:[2](https://github.com/etcd-io/etcd/runs/6141920349?check_suite_focus=true#step:3:2)[3](https://github.com/etcd-io/etcd/runs/6141920349?check_suite_focus=true#step:3:3)
    at processTicksAndRejections (internal/process/task_queues.js:97:5)
    at async Job.doExecute (/home/runner/work/_actions/github/codeql-action/v1/node_modules/bottleneck/light.js:[4](https://github.com/etcd-io/etcd/runs/6141920349?check_suite_focus=true#step:3:4)0[5](https://github.com/etcd-io/etcd/runs/6141920349?check_suite_focus=true#step:3:5):18) {
  status: 403,

[serathius]

Heh, this is not a question, but a bug report.
cc @adityasharad

[MathiasVP]

Hi @serathius,

In general, that error usually indicates something wrong with GitHub Actions token permissions.

It looks like you've changed your default token permissions to be restrictive by default without updating the workflow to include the permissions needed for Code Scanning.

Updating the permissions to:

permissions:
  actions: read
  contents: read
  security-events: write

should fix your issue.

[serathius]

Thanks for info, however please stop introducing breaking changes in v1 version.

[MathiasVP]

I don't think we introduced any breaking changes in this case. These permissions have been the suggested defaults for a long time. You can check out the readme on https://github.com/github/codeql-action for the details.

[L3m0nb4tt3ry]

@MathiasVP Not necessarily the same issue, but I am receiving same error while fetching dependabot issues via a graphql query, I tried with permissions: write-all as well but no luck. I can execute same query with my PAT with
repo permissions(i.e Full control of private repositories) but unable to fetch with default token, not sure what exactly is the reason or issue here.

[MathiasVP]

Hi @L3m0nb4tt3ry,

Thanks for posting! We'll be happy to take a look at your situation. Would you mind opening a fresh issue with this?

[o0101]

Hi @serathius,

In general, that error usually indicates something wrong with GitHub Actions token permissions.

It looks like you've changed your default token permissions to be restrictive by default without updating the workflow to include the permissions needed for Code Scanning.

Updating the permissions to:

permissions:
  actions: read
  contents: read
  security-events: write

should fix your issue.

Thank you @MathiasVP that fixed it for us