GitHub attest-build-provenance "Resource not accessible by integration" in CI

By Kaveh Alemi·Latchkey

actions/attest-build-provenance writes a signed provenance attestation via the GitHub API. "Resource not accessible by integration" means the job token lacks the attestations: write (and id-token: write) permissions the action requires.

What this error means

The attest step fails with "Resource not accessible by integration" or a 403 when it tries to create the attestation, even though the build succeeded.

Error: Failed to persist attestation: Resource not accessible by integration -
https://docs.github.com/rest/repos/repos#create-an-attestation

Common causes

Missing attestations: write permission

Creating an attestation requires attestations: write. The default token or a restricted permissions block does not include it.

Missing id-token: write for keyless signing

The action signs the provenance keyless via Sigstore and needs id-token: write to mint the OIDC token; without it, signing fails too.

How to fix it

Grant the required permissions

1. Add attestations: write and id-token: write to the job.
2. Keep contents: read (and packages: write if attesting a pushed image).
3. Re-run the attest step.

permissions:
  id-token: write
  attestations: write
  contents: read
  packages: write
steps:
  - uses: actions/attest-build-provenance@v1
    with:
      subject-name: ghcr.io/acme/app
      subject-digest: ${{ steps.build.outputs.digest }}
      push-to-registry: true

Check org policy allows attestations

If permissions look correct but the call is still refused, confirm the organization has not disabled artifact attestations for the repository.

How to prevent it

• Set attestations: write and id-token: write on any attest job.
• Scope permissions at the job level so only that job can attest.
• Confirm org policy permits artifact attestations.

Frequently asked questions

Related guides

References

• GitHub Actions documentation