create-code-scanning-alert: upload_code_scanning_sarif job missing `actions: read`, fails on private repos

[mrfelton]

Summary

The upload_code_scanning_sarif job generated for the create-code-scanning-alert safe-output is created with only contents: read + security-events: write. On a private repository, github/codeql-action/upload-sarif also needs actions: read (it calls the get-a-workflow-run REST endpoint while attaching the analysis). As a result, the upload fails:

Error: Resource not accessible by integration -
https://docs.github.com/rest/actions/workflow-runs#get-a-workflow-run

Where

pkg/workflow/create_code_scanning_alert.go → buildCodeScanningUploadJob:

// Permissions: contents:read to checkout, security-events:write to upload SARIF
permissions := NewPermissionsContentsReadSecurityEventsWrite()

The job that runs github/codeql-action/upload-sarif therefore never receives actions: read.

Why a token override doesn't help

upload-sarif's own action.yml states the token must be the built-in GITHUB_TOKEN:

"The token must be the built-in GitHub Actions token, and the workflow must have the security-events: write permission."

So create-code-scanning-alert.github-token set to a PAT (fine-grained or classic) does not work — the action's internal CodeQL Action API endpoints are only reachable by the built-in integration token (a PAT yields does not have permission to access the CodeQL Action API endpoints / Resource not accessible by personal access token). The only viable fix is granting the built-in token actions: read on the generated job.

Evidence

• GitHub's own guidance for this exact error: codeql/upload-sarif@v3 action failed: Resource not accessible by integration - missing actions: read codeql-action#2117 — "When you're facing this issue in a private repository please add permissions: actions: read to your workflow."
• Docs: https://docs.github.com/en/code-security/code-scanning/troubleshooting-sarif-uploads/missing-token
• Verified empirically on a private repo: an isolated job with permissions: { actions: read, contents: read, security-events: write } using the default GITHUB_TOKEN → "Successfully uploaded results". The same job without actions: read → the error above.

Proposed fix

Add actions: read to the upload_code_scanning_sarif job's permissions (it is harmless on public repos and required on private ones), e.g. a NewPermissionsActionsReadContentsReadSecurityEventsWrite() variant for buildCodeScanningUploadJob.

Environment

• gh-aw v0.77.5 (also present on main at time of writing)
• Private repository with GitHub Advanced Security / code scanning enabled