Resource not accessible by integration when using GitHub App about repository-dispatch

[mike-pisman]

Okay, I figured it out.
As always, I missed a small detail which caused all the trouble. The actions/create-github-app-token by default only generates a token for the current repository. To generate a token for all repositories it's important to specify the owner, i.e. owner: ${{ github.repository_owner }}

    steps:
      - name: Generate a token
        id: generate_token
        uses: actions/create-github-app-token@v1
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.APP_PEM }}
          # Set the owner, so the token can be used in all repositories
          owner: ${{ github.repository_owner }}

[peter-evans]

Hi @mike-pisman

This error often occurs because the workflow is being triggered by a fork opening a PR. In that case, the workflow has no access to secrets for security reasons. How is your workflow being triggered? You gave a sample of your workflow, but it doesn't show the on triggers at the top.

[mike-pisman]

Hi @peter-evans, I am currently using workflow_dispatch on the main branch of non-forked repository.
The full workflow:

name: Update docs

on:
  workflow_dispatch:
  gollum:

jobs:
  docs: 
    runs-on: arc-runner-k8s
    permissions:
      actions: write
      contents: write
    steps:
      - name: Generate a token
        id: generate_token
        uses: actions/create-github-app-token@v1
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.APP_PEM }}
      - name: Repository Dispatch
        uses: peter-evans/repository-dispatch@v2
        with:
          token: ${{ steps.generate_token.outputs.token }}
          repository: unipoll/gollum-test
          event-type: update_submodules

And here is a link to the job: https://github.com/unipoll/angular/actions/runs/6387166198

[mike-pisman]

I've tried generating JWT token, sending HTTP requests with curl, using --user "APP_ID:APP_SECRETE instead of token, but nothing seems to work when trying to perform request with app credentials, I still get Resource not accessible by integration. I must be doing something wrong with app configuration, even though I have set all the permissions as recommended in documentation.

At last I tried using PAT token, just to make sure it wasn't some other issue. With the PAT token, the workflow and repository-dispatch action worked and successfully triggered a workflow in the gollum-test repository.

Using PAT, however, does not work for me, so I will stick to manually triggering the workflow for now.

I would appreciate, if you keep this issue open, in case someone else, who's also using GitHub App, will figure it out the solution. If I manage to resolve the problem, I will make sure to post it here.