CodeQL "Resource not accessible by integration" (security-events) in CI

By Kaveh Alemi·Latchkey

Uploading code scanning results requires the security-events: write permission on the GITHUB_TOKEN. When the token is read-only (the default for many workflows), the API rejects the upload with "Resource not accessible by integration".

What this error means

The CodeQL analyze or upload-sarif step fails with "Resource not accessible by integration" (HTTP 403) when posting SARIF, even though extraction succeeded.

Error: Resource not accessible by integration
RequestError [HttpError]: Resource not accessible by integration (403)
at ... uploading results to Code Scanning

Common causes

The workflow lacks security-events: write

Without an explicit permissions block granting security-events: write, the token cannot post results to the code scanning API.

The default token is read-only for the repo/org

Org or repo settings restrict the default GITHUB_TOKEN to read, so any write scope must be requested explicitly in the workflow.

How to fix it

Grant security-events: write

1. Add a permissions block to the job (or workflow).
2. Include security-events: write plus contents: read and actions: read.
3. Re-run so the upload has permission to post SARIF.

permissions:
  contents: read
  actions: read
  security-events: write

Check org default token permissions

If the org forces read-only tokens, the workflow-level permissions block still applies; ensure no org policy strips write scopes for this repo.

How to prevent it

• Always set security-events: write in code scanning workflows.
• Grant least-privilege permissions explicitly rather than relying on defaults.
• Test upload permissions on a fork or branch before rollout.

Frequently asked questions

Related guides

References

• GitHub Actions documentation