github_my_repository Table Erroring With Fine-Grained Personal Access Token

[andy-werderman]

Describe the bug

I am using a Fine-Grained PAT with all of the proper permissions. I set the organization as the resource owner for the PAT (instead of the user account itself). See the permissions configured in the screenshot.

The github_my_repository table then errors with Error: github: Resource not accessible by personal access token (SQLSTATE HV000).

When the same PAT is used to query the /user/repos API endpoint, it returns the expected set of repositories.

One thing to note, my organization requires SSO, although I would assume that issue would also present itself when using the REST API as well which is not happening. I think that part is solved by setting the organization as the resource owner.

When I use a Classic PAT and Configure SSO for the token, I am able to query all repos:

> select count(*) from github_my_repository;
+-------+
| count |
+-------+
| 1,637 |
+-------+

Steampipe version (steampipe -v)
Steampipe v2.2.0

Plugin version (steampipe plugin list)
v1.6.0

To reproduce

1. Set the GITHUB_TOKEN environment variable to the fine grained token

export GITHUB_TOKEN=github_pat_...

2. Query the github_my_repository table:

> select * from github_my_repository;

Error: github: Resource not accessible by personal access token (SQLSTATE HV000)

Expected behavior
I would expect the github_my_repository table to be populated with all of the repositories in my organization (about 900 unarchived repositories).

Additional context
Slack thread: https://turbot-community.slack.com/archives/C06MZTFN90E/p1759427055096539

[khushboo9024]

Hi @andy-werderman, Thanks for raising this issue!

We’ve been able to replicate this issue on our end. It seems to happen when there’s at least one personal account repo along with org-level repos while using a fine-grained personal access token.

Org repos work fine, but when the table tries to fetch certain fields (like hooks) for personal repos, the token doesn’t have the required permissions, which leads to the Resource not accessible by personal access token error.

Could you check if you have any repos under your personal account in your setup? That would help confirm if it’s the same root cause we saw.

Thanks!!

[andy-werderman]

Could you check if you have any repos under your personal account in your setup? That would help confirm if it’s the same root cause we saw.

yes it looks like there is one public repository for the account in use (seemingly created by GitHub by default).

[khushboo9024]

@andy-werderman We suspect a limitation with fine-grained access tokens; the available scopes appear too restrictive for this use case. We’re investigating from our side and will share findings.

Thanks.

[khushboo9024]

Hi @andy-werderman,

We’ve identified that the github_my_repository table was throwing errors on the hooks and interaction_ability columns when using a fine-grained access token due to insufficient permissions.

As a workaround, we’ve updated the code to skip these two columns when a fine-grained access token is used. We’ve raised a PR with this change — could you please take a look from your side and let us know if you have any concerns or suggestions?

Thanks!