What permission does GitHub app need to execute gh pr view and gh pr merge --auto?

[bikram-agarwal]

I created a GitHub app, got it installed in the repo in our org, got these permissions granted to it -

• Read access to members, metadata, and repository projects
• Read and write access to commit statuses and pull requests

Most of the commands I need the app to run are running fine, except these two -

gh pr view

gh pr view 1234
This is failing with -
GraphQL: Resource not accessible by integration (repository.pullRequest.statusCheckRollup.nodes.0), Resource not accessible by integration (repository.pullRequest.statusCheckRollup.nodes.0)

But this is working fine -

gh pr view 1234 --json createdAt,baseRefName,autoMergeRequest,title --jq '.createdAt,.baseRefName,.autoMergeRequest,.title'

So, looks like the statusCheckRollup thing is tripping the unfiltered gh pr view. The app already has RW permission to commit statuses and PRs. What other permission do I need to get for the app for this?

gh pr merge

These commands are failing -

gh pr merge 1234 --auto --merge
gh pr merge 1234

with this error -
GraphQL: Resource not accessible by integration (repository.pullRequest.commits.nodes.0)

The app already has write permission to the PRs. What other permission do I need to get for the app for this?

[andyfeller]

@bikram-agarwal : Since these GitHub CLI commands are pulling data out of GitHub's GraphQL API objects, the object field paths in the error message are one way I would troubleshoot permission scoping:

• repository.pullRequest.statusCheckRollup are StatusCheckRollup, which should fall under the Checks repository permission given the description in the docs:

  Represents the rollup for both the check runs and status for a commit.

• repository.pullRequest.commits
  This should fall under the Contents repository permission given the description in the GitHub App permissions page:

  Repository contents, commits, branches, downloads, releases, and merges.

I hope this helps. However if this doesn't, I also recommend reaching out to GitHub Support via https://support.github.com/.

[bikram-agarwal]

Thanks for the guidance @andyfeller. With this info, I submitted a ticket with my org's admins, and they granted read-write access to "code". So, the app's permission now looks like this -

• Read access to members, metadata, and repository projects
• Read and write access to code, commit statuses and pull requests

The app is now able to do gh pr view and gh pr merge.

Thanks again.

[andyfeller]

Happy to help!