Org Team Approver Documentation Issue

[obalyuk87]

Thank you for creating and sharing an amazing plugin!

The docs on the "Org Team Approver" have limited / incorrect information, the the extra "Permissions" section is misleading.
https://github.com/marketplace/actions/manual-workflow-approval#org-team-approver

I followed the docs for Team Approver setup but pipeline was failing with error below

Required approvers: [user1 user2 user3]

Respond "approved", "approve", "lgtm", "yes" to continue workflow or "denied", "deny", "no" to cancel.
error creating issue: POST https://api.github.com/repos/my-org/misc-prototypes/issues: 403 Resource not accessible by integration []

In case of explicitly listed users the trstringer/manual-approval@v1 step is executed with secret: ${{ github.TOKEN }}. However in case of Org Team Approver secret: ${{ steps.generate_token.outputs.token }} is used. Per docs, the GitHub app was created with read-only access to organization members, which is not enough to create an issue in the repo. Once I added "Issues Write" permission to the GitHub app - the workflows worked as expected!

App Permissions

[rjcoupe]

I ran into the same problem and came to the same solution.

[afrazkhan]

It works for me with the additional permission up until the actual approval message, which never gets picked up. Issue is created, and even cancelled when the run is cancelled manually, but replying to the created issue with an approved response never gets picked up by the action.

I've tried adding the "Issue comment" event to the permissions, which seems like an obvious necessity, but still no joy.

[cwong-archy]

i have this issue. i have set the github app with the correct permissions (i think)

but still getting -

Required approvers: [eng-release]

Respond "approved", "approve", "lgtm", "yes", "ok", "lfg", "ship it" to continue workflow or "denied", "deny", "no" to cancel.
error creating issue: POST https://api.github.com/repos/ORG/REPO/issues: 403 Resource not accessible by integration []

my gha -

  wait-for-approval:
    runs-on: self-hosted-deploy-dev
    steps:
      - id: generate-token
        uses: tibdex/github-app-token@v1
        with:
          app_id: ${{ secrets.GHA_WAIT_FOR_APPROVAL_APPID }}
          private_key: ${{ secrets.GHA_WAIT_FOR_APPROVAL_PRIVATE_KEY }}
      - id: manual-approval
        uses: trstringer/manual-approval@v1
        with:
          secret: ${{ steps.generate-token.outputs.token }}
          approvers: eng-release
          minimum-approvals: 1
          additional-approved-words: ok,lfg,ship it