actions/github-script "Resource not accessible by integration" (contents: write missing)

github-script calls run as the GITHUB_TOKEN integration. When the workflow permissions block omits the scope the call needs, GitHub returns 403 "Resource not accessible by integration".

What this error means

A github-script write call (create a commit, tag, release asset, dispatch) fails with "Resource not accessible by integration".

github-actions

RequestError [HttpError]: Resource not accessible by integration
    status: 403
##[error]Unhandled error: HttpError: Resource not accessible by integration

Common causes

Default read-only token

Repos with the default restricted token grant only contents: read, so any write API returns 403.

Missing the specific scope

Writing repo content needs contents: write; the scope for the resource being mutated was not declared.

How to fix it

Grant the scope the call needs

Add a permissions block at workflow or job level.
Set the exact scope to write (for example contents: write).
Re-run; the integration now has access.

.github/workflows/tag.yml

permissions:
  contents: write
jobs:
  tag:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            await github.rest.git.createRef({
              ...context.repo,
              ref: 'refs/tags/v1.2.3',
              sha: context.sha,
            });

How to prevent it

Declare a minimal permissions block per workflow and widen only the scope a step needs.
Match the scope name to the resource: contents, issues, pull-requests, packages, etc.