ARC "Actions service ... 403" in CI

By Daniel Zoghalchali·Latchkey

The ARC listener authenticated to the Actions service but received 403 Forbidden. The token is valid but does not carry authorization to administer runners for this org or repository.

What this error means

The listener logs an Actions service response of 403 while acquiring jobs or creating a session. Unlike a 401, the credential is accepted but the action is refused.

ERROR Actions service responded with status code 403
  {"error": "Forbidden: the token does not have permission to
  administer self-hosted runners for this scale set"}

Common causes

App permission granted but not on this scope

The App has runner permission at one level (repo) but the scale set targets another (org), so the Actions service returns 403.

Runner group restricts the credential

A runner group policy or repository allow list prevents this App from managing runners in the targeted group.

How to fix it

Align the App scope with githubConfigUrl

1. Confirm githubConfigUrl target (org versus repo) matches where the App has runner admin.
2. Grant Self-hosted runners: Read and write at that level.
3. Restart the controller and listener so the new token is used.

kubectl rollout restart deploy/arc-gha-rs-controller -n arc-systems

Loosen the runner group policy

In the runner group settings, allow the target repositories and the App so the Actions service permits administration.

How to prevent it

• Keep the credential scope at the same level as githubConfigUrl.
• Review runner group access policies when a scale set is added.
• Distinguish 401 (bad credential) from 403 (scope) when triaging.

Frequently asked questions

Related guides

References

• GitHub Actions documentation