push-to-fork fails with Resource not accessible by personal access token

[oscarbenjamin]

Subject of the issue

I am trying to follow the instructions for push-to-fork with a machine user from here:
https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#push-pull-request-branches-to-a-fork

It currently succeeds in pushing to the machine account's fork but fails to create the pull request back to my repo with:

Create or update the pull request
  Attempting creation of pull request
  Error: Resource not accessible by personal access token

https://github.com/oscarbenjamin/protosym/actions/runs/4583286227/jobs/8094040007

The workflow is in a repo under my account but has been given a fine grained PAT to access the machine account:
https://github.com/oscarbenjamin/protosym/blob/147544959f655f2fc1c5a599e6464d962cff3624/.github/workflows/updater.yml#L22-L23

I'm unsure what this error means as in whether it means that the particular PAT does not have enough permissions or if it is that the action is not something that can be done by any PAT.

The permissions given to the fine grained PAT from the machine account are limited to the machine account's fork ("only select repositories") and are given as:

• Contents read/write
• metadata read
• workflows read/write
• pull requests read/write

In my repo in the actions settings I have ticked the box that says "Allow GitHub Actions to create and approve pull requests". I also tried selecting the "Read and write access" under "workflow permissions".

Is there something else that I am missing here?

[oscarbenjamin]

I switched to using a classic PAT from the machine account with "repo" and "workflow" scope and then it worked.

[oscarbenjamin]

I have tried using a fine grained PAT again and giving it every possible permission to the machine account and all of its repos but it still fails to open the pull request.

Maybe it is just not possible to get this setup working with a fine grained PAT.

[peter-evans]

Hi @oscarbenjamin

Maybe it is just not possible to get this setup working with a fine grained PAT.

That would not surprise me. Fine-grained access tokens are still in beta and I know that GitHub's GraphQL API is not supported yet. This action uses the REST API, which supposedly is supported, but perhaps some edge cases are not covered yet.

Error: Resource not accessible by personal access token

I've not seen this error message before, and it seems likely that the meaning is that the new fine-grained access tokens aren't supported for that particular case.