I have an automation set up that I can trigger from Slack to open a PR. I have the prompt include instructions to add a specific label and to assign a specific person as an assignee to the PR. But it doesn’t seem that there is enough permissions for that: “Resource not accessible by integration”. I don’t see in the Github Cursor plugin a way to authorize additional permissions. There are these:
Read access to administration, commit statuses, custom organization roles, custom repository roles, deployments, members, metadata, organization custom properties for repositories, packages, and pages
Read and write access to actions, checks, code, discussions, issues, pull requests, and workflows
Any plans to allow finer grained control? Or am I being stupid and having a bot assign a label and set an assignee on a PR asking for some kind of trouble that I’m not aware of?
hi @RayGraham Thanks for the post. You’re not missing anything. The permission list you’re looking at is what the GitHub App can hold at install level, but each agent run gets issued a narrower token than that. Adding labels and assignees goes through GitHub’s Issues API, which isn’t in the run token’s scopes, so those calls come back as “Resource not accessible by integration” even though the App itself has Issues read/write.
The workaround people have had success with: create a fine-grained GitHub PAT scoped to the target repo with Issues and Pull requests read/write, then add it as a GH_TOKEN secret in your Cloud Agent environment settings. The gh CLI in the run will pick that up, and the label/assignee steps in your prompt should go through.