Copilot code review cleanup job fails deleting artifacts with 403

[DavidOlmer]

Summary

GitHub Actions run 23775280758 is currently failing in workflow Copilot code review, job Cleanup artifacts, step Delete artifacts.

• Run URL: https://github.com/karpathy/autoresearch/actions/runs/23775280758
• Failing job URL: https://github.com/karpathy/autoresearch/actions/runs/23775280758/job/69276000639
• Branch ref:
  efs/pull/453/head

Error snippet

ext gh: Resource not accessible by integration (HTTP 403) Process completed with exit code 1.

Likely root-cause bucket

Workflow token permissions / integration scope mismatch during artifact deletion.

Smallest safe next steps

• Inspect the token permissions available to the cleanup job.
• Compare artifact deletion permissions with the workflow's current permissions: block.
• Decide whether cleanup should be best-effort instead of fail-fast.

[cym3118288-afk]

Root Cause Analysis

After investigating this issue, I found that this cannot be fixed via a Pull Request because the failing workflow is a GitHub-managed dynamic workflow, not a repository-defined YAML file.

Key Findings

1. Workflow Type: dynamic/copilot-pull-request-reviewer/copilot-pull-request-reviewer

   • This is controlled by GitHub's Copilot PR Reviewer app
   • There is no .github/workflows/*.yml file to modify
   • Repository maintainers cannot directly edit this workflow

2. Permission Mismatch:

   • The token has Actions: write and Metadata: read
   • However, the artifact deletion API (DELETE /repos/{owner}/{repo}/actions/artifacts/{artifact_id}) requires specific scopes that the integration token does not have
   • Error: gh: Resource not accessible by integration (HTTP 403)

3. Why 403 Forbidden:

   • The Copilot app's token may not have the correct scope to delete artifacts
   • Cross-run artifact deletion may require elevated permissions not granted to GitHub App integrations

---

Recommended Actions

For Repository Maintainers (@karpathy)

Option 1: Report to GitHub Support (Recommended)
Since this is a GitHub-managed workflow, only GitHub can fix the underlying permission issue.

• File a support ticket at: https://support.github.com/
• Reference this issue and the failing run: https://github.com/karpathy/autoresearch/actions/runs/23775280758

Option 2: Workaround - Create a Separate Cleanup Workflow

If you want to clean up artifacts independently, you can create .github/workflows/artifact-cleanup.yml:

name: Artifact Cleanup

on:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM UTC
  workflow_dispatch:

permissions:
  actions: write
  contents: read

jobs:
  cleanup:
    runs-on: ubuntu-latest
    steps:
      - name: Clean old artifacts
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Delete artifacts older than 7 days
          gh api /repos/${{ github.repository }}/actions/artifacts \
            --paginate \
            --jq '.artifacts[] | select(.created_at < (now - 86400*7 | strftime("%Y-%m-%dT%H:%M:%SZ"))) | .id' | \
          while read -r artifact_id; do
            echo "Deleting artifact $artifact_id"
            gh api -X DELETE /repos/${{ github.repository }}/actions/artifacts/$artifact_id || true
          done
          echo "Cleanup complete"

Option 3: Configure Artifact Retention Policy

• Go to: Repository Settings → Actions → General → Artifact and log retention
• Set a retention period (e.g., 7 or 14 days)
• Artifacts will be automatically deleted after this period

---

Impact

While this issue causes the "Copilot code review" workflow to show as failed, the actual code review itself succeeds. The failure only occurs in the cleanup job, which is a post-review task.

---

References

• GitHub REST API - Delete an artifact
• GitHub Actions - Automatic token authentication
• Managing GitHub Actions artifact and log retention

---

I hope this analysis helps!