Missing Checks permission in personal access token

[kemchenj]

Select Topic Area

Bug

Body

There is Checks repository permission that listed in 《Permissions required for fine-grained personal access tokens》

But it is missing in the settings：

I wonder if this is a bug or it is intended?

[froblesmartin]

I have just faced this as well. Curious that, as you mention, it is documented in the fine grained page, but not available. Checking in a GitHub App, it does show it:

[richardsimko]

@kemchenj or @froblesmartin Did you figure out some workaround? Seems to still be an issue.

[PhilipAtCisco]

++ I'm also running into this myself this morning trying to setup some CI tests that create PRs to test a reuseable workflow.

PRs created by bots don't run checks (aws/karpenter-provider-aws#4525) so a fine-grained PAT that is repo scoped I believe is the workaround. I think I could swap back to the regular GITHUB_TOKEN for the validation of the checks, but this missing feature would certainly simplify things!

[richardsimko]

Yeah we're in a similar situation but With Renovate. Had to go back to classic tokens.

[F-WRunTime]

Also now running into this as well. Started to lose my mind how hard it was to find this related issue. Glad it it's here
++++

[iufor]

I have same issue facing

[andrewlarioza]

We stumble to this issue as well and good to have the resolution soon.
$ curl -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer github_pat_XXXXX" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/repos/azoiral/devops-test-repo/commits/DEVOPS-3-gatekeeper-v1-3/check-suites { "message": "Resource not accessible by personal access token", "documentation_url": "https://docs.github.com/rest/checks/suites#list-check-suites-for-a-git-reference", "status": "403" }

[andipexton-insight]

To spend hours building a process based on documented functionality that doesn't exist is more than frustrating, it would be nice if someone from @github could give a response? is the error in the documentation or the omission of the feature?

[F-WRunTime]

Great question. Same problem.

[omarabid]

So anyone from Github care to comment or look at this. I spent a whole morning trying to figure out why my "fine-tuned" tokens do not work and it turns out that there was no "Checks" fine tuning.

[frankalbenesius]

Just in case anyone else finds this thread, here was a response I got from emailing support:

I apologize for any inconvenience here, but at the moment, it isn't possible to assign Checks permissions to a Fine-grained PAT —only GitHub Apps can access this API. We had that functionality initially, but due to some edge cases we disabled it.

Our engineering team have an issue tracking this and we've added your interest to the issue. In future, we may re-introduce the ability to configure Fine-grained PATs with permissions to run Checks API. When we do publish it, we'll make sure to document it in the GitHub Changelog or the GitHub Blog.

As an alternative I would suggest to make use of the GitHub App to query the required API endpoints. If you're using Actions as your CI, you can authenticate Actions as a GitHub App.

Summary: Use a GitHub App instead of a PAT.

[Lewenhaupt]

Classic tokens also work!

[voodoodror]

Following check-runs classic token modification deprecation https://github.blog/changelog/2025-02-12-notice-of-upcoming-deprecations-and-breaking-changes-for-github-actions/#changes-to-check-run-status-modification

Check run status and conclusions can only be updated internally by GitHub Actions.

The documentation says that fine-grained tokens are supported. Thankfully, I found this issue, and it saved me time from debugging it. I wonder why they wrote it in the docs in the first place if they know it's not supported.

[aredridel]

I have a strong suspicion that Copilot wrote the docs and nobody checked. That AI mandate bears this fruit often.

[NedWilbur]

It seems the official API docs are ahead of what is actually supported today...

API Docs - https://docs.github.com/en/rest/checks/runs?apiVersion=2022-11-28#get-a-check-run

[phenggeler]

It sounds like Github is planning to deprecate classic tokens. The community will need Checks to be supported for fine-grained access tokens before that happens. Would love to see progress on this by Github