GitHub Actions "Resource not accessible" Creating a Check Run

By Kaveh Alemi·Latchkey

An action that publishes a check run or rich annotations (test reporters, linters) fails with a 403 because the workflow token is missing the checks: write permission.

What this error means

A reporting action errors with "Resource not accessible by integration" when creating a check run, while the underlying test or lint step itself ran fine.

Error: HttpError: Resource not accessible by integration
  status: 403
  POST /repos/org/repo/check-runs

Common causes

Missing checks: write permission

Publishing check runs and annotations requires checks: write. Under restricted defaults this is not granted, so the API rejects the call.

Token from a fork PR is read-only

For pull_request runs from forks, the token is read-only regardless of the permissions block, so check writes are denied for safety.

How to fix it

Grant checks: write

permissions:
  contents: read
  checks: write
jobs:
  test:
    runs-on: ubuntu-latest

Handle fork PRs separately

1. For fork PRs, upload results as an artifact and publish checks from a pull_request_target or workflow_run job in the base repo.
2. Never expose write tokens directly to untrusted fork code.
3. Grant checks: write only on the job that publishes results.

How to prevent it

• Add checks: write only where a reporter publishes check runs.
• Route fork-PR reporting through workflow_run to keep tokens safe.
• Keep the rest of the permissions block least-privilege.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions