Cloud agent cannot restart failed PR check

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cloud Agent (GitHub, Slack, Web, Linear)

Describe the Bug

When asking a cloud agent to babysit a PR. I found that it does not have the necessary permissions in its token:

403 Resource not accessible by integration

Steps to Reproduce

Ask a cloud agent to rerun a GitHub check

Expected Behavior

Cloud agent can rerun a check

Operating System

MacOS

Version Information

Cloud agents only, n/a

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey, thanks for the report. This isn’t actually a bug, it’s intended behavior. The GitHub token that the cloud agent gets is intentionally minted with a limited scope (actions: read). But gh run rerun and restarting a workflow need actions: write, so GitHub returns 403 Resource not accessible by integration. The local agent works because it uses your own gh session with broader permissions.

For now, here are a couple workarounds so you’re not blocked:

  • Restart the check manually from the GitHub UI.
  • Ask the agent to push an empty commit: git commit --allow-empty -m "retrigger CI". That will retrigger CI, and the agent does have contents:write.

Being able to configure GitHub permissions for cloud agents is something we’re tracking as a request. I don’t have an exact timeline yet, but I added your vote. Related thread if you want updates: GitHub Actions Write Permission