Can't create PRs to other repos with fine grained GithubApp user access token

[Leonidas-from-XIV]

Select Topic Area

Question

Body

Hi,

I've created a GitHub app so I can use the device flow to create a user auth token. The app has the Pull Requests: read & write permission enabled, is installed to my account and can access to all my repos. I successfully managed to create PRs against my own repo.

But when I attempt to create a PR of a branch from my repo (I'm $owner) to the repo my repo was forked like this:

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer ${token}" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  "https://api.github.com/repos/${target_owner}/${target_repo}/pulls" \
  -d "{ \"title\" : \"${pr_title}\", \"body\" : \"${pr_body}\", \"head\": \"${owner}:${branch_name}\", \"head_repo\": \"${owner}/${repo}\", \"base\" : \"${pr_base}\" }")

I get an error message:

{ "message": "Resource not accessible by integration", "documentation_url": "https://docs.github.com/rest/pulls/pulls#create-a-pull-request", "status": "403" }

The $target_owner is another user and if I just use the web UI then it works just fine. If I look at the HTTP headers, I see that it seems to want the pull_requests=write permission which I have. The token is still valid and the rate limits have not been hit.

< x-accepted-github-permissions: pull_requests=write

So my question is what am I doing wrong? Does the app need to be installed into the repo of the other user? That makes it difficult to automate if I can only create PRs to repos which have my GH app installed.

[Earthcomputer]

I'm having the exact same issue. It's breaking Weblate's GitHub integration

[crazyboyze]

To create PRs with a fine-grained GitHub App token, ensure the app has Write permissions for Contents and Pull Requests, is installed on the target repository, and has access to the correct branch. Check branch protection rules, token scopes, and API usage for issues. Adjust settings as needed. Click Here!