Summary
The Create an issue comment reference says that a GitHub App installation access token needs at least one of these permission sets:
Issues repository permission: writePull requests repository permission: write
In a live GitHub App installation, Issues: write plus Pull requests: read was insufficient for creating a regular timeline comment on a pull request via POST /repos/{owner}/{repo}/issues/{issue_number}/comments.
Reproduction
- Install a GitHub App on one selected private repository with these repository permissions:
Contents: read, Pull requests: read, Checks: write, Issues: write, and Metadata: read.
- Create an installation access token.
POST /repos/{owner}/{repo}/issues/{pull_number}/comments with a normal JSON body.
Expected result
The request succeeds because the token has Issues: write, one of the two documented alternatives.
Actual result
The request returns HTTP 403. GitHub's X-Accepted-GitHub-Permissions response header identifies both issues=write and pull_requests=write as required. The installation token's effective permissions were issues=write and pull_requests=read (along with unrelated read/check permissions).
After granting Pull requests: write to the same selected-repository installation, the identical application flow could create and update the PR timeline comment. Check Run publication succeeds in both permission configurations.
Could you clarify whether the runtime behavior or the REST API reference is correct?
Summary
The Create an issue comment reference says that a GitHub App installation access token needs at least one of these permission sets:
Issuesrepository permission:writePull requestsrepository permission:writeIn a live GitHub App installation,
Issues: writeplusPull requests: readwas insufficient for creating a regular timeline comment on a pull request viaPOST /repos/{owner}/{repo}/issues/{issue_number}/comments.Reproduction
Contents: read,Pull requests: read,Checks: write,Issues: write, andMetadata: read.POST /repos/{owner}/{repo}/issues/{pull_number}/commentswith a normal JSONbody.Expected result
The request succeeds because the token has
Issues: write, one of the two documented alternatives.Actual result
The request returns HTTP 403. GitHub's
X-Accepted-GitHub-Permissionsresponse header identifies bothissues=writeandpull_requests=writeas required. The installation token's effective permissions wereissues=writeandpull_requests=read(along with unrelated read/check permissions).After granting
Pull requests: writeto the same selected-repository installation, the identical application flow could create and update the PR timeline comment. Check Run publication succeeds in both permission configurations.Could you clarify whether the runtime behavior or the REST API reference is correct?