Resource not accessible by integration

Hello,

We are migrating our CI from CircleCI to Github Actions. I've updated my bors.toml file to something like:

status = [
    "Test (ubuntu-latest)",
    "Test (macos-latest)",
]
required_approvals = 0
timeout_sec = 900
delete_merged_branches = true

Only the status item has been updated to match Gtihub Actions status.

But since then, Bors creates a stating.tmp branch, pushes commits on it, which triggers Github Actions, but then Bors fails with this message (from the dashboard):

{{:badmatch,
  {:error, :merge_branch,
   %Tesla.Env{
     __client__: %Tesla.Client{
       adapter: {Tesla.Adapter.Httpc, :call,
        [
          [
            ssl: [
              verify: :verify_peer,
              verify_fun: {&:ssl_verify_hostname.verify_fun/3,
               [check_hostname: 'api.github.com']},
              cacertfile: '/app/_build/prod/lib/certifi/priv/cacerts.pem'
            ]
          ]
        ]},
       fun: nil,
       post: [],
       pre: [
         {Tesla.Middleware.BaseUrl, :call,
          ["https://api.github.com"]},
         {Tesla.Middleware.Headers, :call,
          [
            [
              {"authorization",
               "token v1.…"},
              {"accept", "application/vnd.github.v3+json"},
              {"user-agent", "bors-ng https://bors.tech"}
            ]
          ]},
         {Tesla.Middleware.Retry, :call,
          [[delay: 100, max_retries: 5]]}
       ]
     },
     __module__: Tesla,
     body: "{\"message\":\"Resource not accessible by integration\",\"documentation_url\":\"https://developer.github.com/v3/repos/merging/#perform-a-merge\"}",
     headers: [
       {"date", "Mon, 16 Dec 2019 16:12:49 GMT"},
       {"server", "GitHub.com"},
       {"content-length", "137"},
       {"content-type", "application/json; charset=utf-8"},
       {"status", "403 Forbidden"},
       {"x-ratelimit-limit", "5000"},
       {"x-ratelimit-remaining", "4920"},
       {"x-ratelimit-reset", "1576514802"},
       {"x-github-media-type", "github.v3; format=json"},
       {"access-control-expose-headers",
        "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type"},
       {"access-control-allow-origin", "*"},
       {"strict-transport-security",
        "max-age=31536000; includeSubdomains; preload"},
       {"x-frame-options", "deny"},
       {"x-content-type-options", "nosniff"},
       {"x-xss-protection", "1; mode=block"},
       {"referrer-policy",
        "origin-when-cross-origin, strict-origin-when-cross-origin"},
       {"content-security-policy", "default-src 'none'"},
       {"x-github-request-id",
        "820F:12C0:094E:166A:5DF7AD01"}
     ],
     method: :post,
     opts: [],
     query: [],
     status: 403,
     url: "https://api.github.com/repositories/176312472/merges"
   }}},
 [
   {BorsNG.GitHub, :merge_branch!, 2,
    [file: 'lib/github/github.ex', line: 124]},
   {Enum, :"-reduce/3-lists^foldl/2-0-", 3,
    [file: 'lib/enum.ex', line: 1940]},
   {BorsNG.Worker.Batcher, :start_waiting_batch, 1,
    [file: 'lib/worker/batcher.ex', line: 322]},
   {BorsNG.Worker.Batcher, :poll_, 1,
    [file: 'lib/worker/batcher.ex', line: 220]},
   {BorsNG.Worker.Batcher, :handle_info, 2,
    [file: 'lib/worker/batcher.ex', line: 183]},
   {:gen_server, :try_dispatch, 4,
    [file: 'gen_server.erl', line: 637]},
   {:gen_server, :handle_msg, 6,
    [file: 'gen_server.erl', line: 711]},
   {:proc_lib, :init_p_do_apply, 3,
    [file: 'proc_lib.erl', line: 249]}
 ]}

The PR is here https://github.com/wasmerio/python-ext-wasm/pull/101.

Any help is very welcomed, I don't clearly understand what happens here.

Thanks!

I've been stumped by this error for ages. Sorry.

The PR in question (https://github.com/wasmerio/python-ext-wasm/pull/101) modifies one or more GitHub Actions workflow files (https://github.com/wasmerio/python-ext-wasm/pull/101/files).

GitHub Apps are not allowed to modify GitHub Actions workflow files.

You’ll need to merge this pull request manually.

2 Likes

That makes sense. Thank you!

Actually, editing a Github workflow isn't the culprit, see https://github.com/wasmerio/go-ext-wasm/pull/103 (another PR).

That build succeeded and Bors merged it. Where is the issue?

It has been merged, but I still see the error in the Bors' dashboard.

Can you post the new error?

Same as above (first post).

body: "{\"message\":\"Resource not accessible by integration\",\"documentation_url\":\"https://developer.github.com/v3/repos/merging/#perform-a-merge\"}",

Strange. But if Bors successfully merged the PR, I wouldn’t worry about it.

I'm hitting exactly the same error in this PR https://github.com/rchain/rchain/pull/2827. In my case Bors crashes before it does anything else. So no merge to trying/staging branch, and therefore no merge to the base branch.

This PR check from a Drone instance to GitHub Actions check:

...
diff --git a/bors.toml b/bors.toml
...
 status = [
-  "continuous-integration/drone/push"
+  "bors build finished"
 ]
...

Heads up. Someone else has found the problem by mailing to GitHub support, see https://github.community/t5/GitHub-Actions/GitHub-action-Resource-not-accessible-by-integration/m-p/19950/highlight/true#M75

OAuth tokens and GitHub Apps are restricted from editing the main.workflow file. This means it isn't possible to merge a Pull Request via an Action if it updates the main.workflow file I'm afraid.

In other words, Bors, a GitHub App, is forbidden to merge a PR that writes into .github/workflows/*. I've tested this is true by renaming .github/workflows to .github/_workflows in the PR above and after that change, Bors started working again. So any changes to .github/workflows/* have to be pushed directly, by user accoutns.

EDIT: Uh, that's what @DilumAluthge said already...