ARC "the GitHub App does not have permission" in CI

By Kaveh Alemi·Latchkey

The ARC controller authenticated as a GitHub App but the App is missing a required permission. Registration and scale-set management need explicit Actions and self-hosted runner scopes that were not granted.

What this error means

The controller logs mention the GitHub App and a permission error while creating or listing runners. Authentication itself succeeds, so this is a scope problem, not a bad key.

ERROR Failed to create ephemeral runner set
  {"error": "the GitHub App does not have permission to
  administer organization self-hosted runners"}

Common causes

Missing self-hosted runner permission on the App

The App can authenticate but was never granted Organization > Self-hosted runners or repository Administration, which registration and listing require.

App installed without the updated permission set

You added the permission in the App definition but did not re-approve it on the installation, so the old scope is still in effect.

How to fix it

Add the permission and re-approve the installation

1. In the App settings, set Self-hosted runners to Read and write.
2. Add Actions: Read where workflow jobs are read.
3. Open the installation and approve the new permission request, then restart the controller pod.

kubectl rollout restart deploy/arc-gha-rs-controller \
  -n arc-systems

Confirm which App and installation are in use

Verify the githubConfigSecret holds the App ID, installation ID, and private key for the App that actually has the permissions.

kubectl get secret pre-defined-secret -n arc-runners \
  -o jsonpath='{.data.github_app_id}' | base64 -d

How to prevent it

• Document the exact App permissions ARC requires and review them on install.
• Re-approve installations after changing App permissions.
• Keep one App per environment so scopes are easy to audit.

Frequently asked questions

Related guides

References

• GitHub Actions documentation