[Bug]: v3.0.2 fails to upload assets to an existing release with Resource not accessible by integration

[danoli3]

Pre-flight checks

token: ${{ secrets.GITHUB_TOKEN }}

• I searched existing issues and did not find a duplicate
• I reproduced this with the latest released version or current master
• I included a reproducible example or a sanitized/redacted reproduction path if the original repository is private

action-gh-release version

3.0.2

Runner operating system

ubuntu-latest

Release target repository

openframeworks/apothecary

Reproduction repo, gist, or artifact

https://github.com/openframeworks/apothecary/actions/runs/31699150761/job/94443778031

Workflow snippet

name: Reproduce action-gh-release failure

  on:
    push:
      branches:
        - bleeding

  permissions:
    contents: write

  jobs:
    release:
      runs-on: ubuntu-latest

      steps:
        - uses: actions/checkout@v7

        - name: Create test asset
          run: echo "test" > release-test.txt

        - name: Update existing release
          uses: softprops/action-gh-release@v3.0.2
          with:
            token: ${{ secrets.GITHUB_TOKEN }}
            tag_name: latest
            files: release-test.txt
            overwrite_files: true

Expected behavior

The action should:

1. Find the existing release associated with the latest tag.
2. Replace matching assets because overwrite_files defaults to true.
3. Complete successfully.

The workflow trigger ref, refs/heads/bleeding, should not affect selection of
the release because tag_name: latest is explicitly supplied.

Actual behavior

The action successfully finds the correct release:

Found release latest (with id=184273939)

It then fails before uploading the assets:

⚠️ Unexpected error fetching GitHub release for tag refs/heads/bleeding:
HttpError: Resource not accessible by integration

The linked API documentation identifies the failed operation as updating a
release:

https://docs.github.com/rest/releases/releases#update-a-release

The error message is also misleading: it reports the workflow ref, refs/heads/
bleeding, as the release tag even though the configured and successfully
resolved release tag is latest.

Steps to reproduce

1. Create a GitHub release associated with a floating tag named latest.
2. Configure a workflow that runs on a branch push.
3. Grant the workflow contents: write.
4. Use softprops/action-gh-release@v3.0.2.
5. Set tag_name: latest.
6. Upload an asset to the existing release.

Minimal workflow:

Relevant logs

Run softprops/action-gh-release@v3.0.2
    with:
      token: ***
      tag_name: latest
      draft: false
      files: out/openFrameworksLibs_latest_linux_64_gcc10.tar.bz2
             out/openFrameworksLibs_latest_linux_64_gcc10.tar.bz2.sha256
             out/openFrameworksLibs_latest_linux_64_gcc10.tar.bz2.manifest.json
      overwrite_files: true
    env:
      TARGET: linux
      TYPE: linux
      ARCH: 64
      GCC: gcc10
      RELEASE: latest

  Found release latest (with id=184273939)
  ⚠️ Unexpected error fetching GitHub release for tag refs/heads/bleeding:
  HttpError: Resource not accessible by integration -
  https://docs.github.com/rest/releases/releases#update-a-release

  Error: Resource not accessible by integration

Additional context

v3.0.1 worked
v3.0.2 failing to push to tag

After upgrading from softprops/action-gh-release@v3.0.1 to v3.0.2, uploading
assets to an existing floating release started failing.

The workflow runs on a push to the bleeding branch and publishes assets to an
existing release whose tag is latest.

The workflow explicitly grants:

permissions:
contents: write

The same release workflow previously worked with v3.0.1.

Pinning the workflow back to v3.0.1 is being used as the current regression
test/workaround.

Repository:

openframeworks/apothecary

Workflow permission:

permissions:
contents: write

Event and refs:

Event: push
Workflow ref: refs/heads/bleeding
Configured release tag: latest
Resolved release: latest
Resolved release ID: 184273939

It appears that v3.0.2 finds the existing release and then calls the update-
release endpoint before uploading assets. That update request receives HTTP
403 even though the workflow has contents: write. The diagnostic subsequently
labels config.github_ref as the release tag, obscuring that tag_name: latest
was resolved correctly.

[danoli3]

On Furher inspection... it seems
token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}

maybe the solution.

[danoli3]

Yes it seems ${{ secrets.PAT_TOKEN }} is required now since v3.0.2 and v3.0.1 didn't require this

Failed:
token: ${{ secrets.GITHUB_TOKEN }}

Works:
token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}

[danoli3]

Actually maybe its just an error with

Found release latest (with id=184273939)
⚠️ Unexpected error fetching GitHub release for tag refs/heads/bleeding: HttpError: Resource not accessible by integration - https://docs.github.com/rest/releases/releases#update-a-release
Error: Resource not accessible by integration - https://docs.github.com/rest/releases/releases#update-a-release

HttpError: Resource not accessible by integration