403 in the check-run api call when passing a Github app token #538
Description
Describe the bug
A default Github App creates the initial check-run when the workflow is first triggered. If you pass in your own Github App token (my tf modules are in different repos under a private org), gh api check-run does not let you patch the check summary and title resulting in a 403
The error you see is:
gh: Invalid app_id 15368 - check run can only be modified by the GitHub App that created it. (HTTP 403)
if allow the default ${{ github.token }} to be used with gh api create-run, then this would be fine
To Reproduce
on:
pull_request:
branches:
- "main"
jobs:
provision:
runs-on: ubuntu-latest
permissions:
actions: read # Required to identify workflow run.
checks: write # Required to add status summary.
contents: read # Required to checkout repository.
id-token: "write" # Required to authenticate with Workload Identity Federation.
pull-requests: write # Required to add PR comment.
steps:
- uses: actions/checkout@v5
- uses: hashicorp/setup-terraform@v3
with:
terraform_wrapper: false
- uses: actions/create-github-app-token@v1
name: Generate Github app token
id: app-token
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
owner: ${{ github.repository_owner }}
# Run plan by default, or apply on merge.
- uses: OP5dev/TF-via-PR
with:
working-directory: terraform/hello
command: 'plan'
arg-lock: false
plan-encrypt: "test123"
token: ${{ steps.app-token.outputs.token }}
Expected behavior
Expect the check status to be updated