GitHub Actions: 'Error: Resource not accessible by integration' (HttpError 403) when a workflow comments, labels, pushes or creates a release with GITHUB_TOKEN

Cause: the GITHUB_TOKEN for the run doesn't have the permission the API call needs. The usual reasons: - The repository or organization default for workflow permissions is read-only (the default for new repos and orgs), and the workflow doesn't request write scopes. - A permissions: block in the workflow lists some scopes; every scope not listed is set to none. - The run was triggered by a pull request from a fork (or by Dependabot): GITHUB_TOKEN is then read-only and secrets aren't available, regardless of the permissions block. - The call needs something GITHUB_TOKEN can never do, such as changing workflow files, acting across repositories, or org-level operations. How to check: open the run's 'Set up job' step, which lists the GITHUB_TOKEN permissions it received, and note the event (pull_request from a fork shows the head repository as the fork). Fix: 1. Grant only what the job needs in the workflow, for example permissions: contents: write (push, releases), pull-requests: write (PR comments, labels), issues: write, packages: write. Prefer setting it per job. 2. Or change Settings, Actions, General, Workflow permissions to read and write, though explicit per-workflow permissions are safer. 3. For fork PRs: keep the build and test workflow on pull_request (read-only), and do the commenting or labelling in a separate workflow triggered by workflow_run or pull_request_target that never checks out or runs the fork's code. Running untrusted PR code with write tokens or secrets is a known way repositories get compromised. 4. For cross-repository or workflow-file changes, use a GitHub App installation token or a fine-grained PAT stored as a secret, scoped to just what's needed. After: re-run the job and confirm the step succeeds; keep the repository default at read-only and grant write per job. Sources: https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions https://github.com/orgs/community/discussions/57878