👋 Hey @bkwhite, that repository is private so I don’t have access to it.

Are you creating these check runs with the GITHUB_TOKEN or a token generated by a GitHub app?

Hello! Sorry that repo got moved to an org.

Here is the new link cypress-check/index.ts at 4237cf576cfa4e7c10da9f81efaf163ce65ca9f3 · soomo/cypress-check · GitHub. We were trying to set the details_url in the octokit.checks.create function and not having any luck.

We are using the token that is passed from the action into the check run.

Thanks to everyone helping here!

@joshmgross - can you give me some hints about how to “use a different token”? What kind of token would work here? Does it have to be an app, or can I use a personal access token?

It would need to be from a GitHub App, as the Checks API only works with Apps.

Hi @joshmgross thanks for answering this question. I just ran into this too.

Is there any documentation describing this limitation? Would you be willing to expand on why it’s not supported? It seems like it’d be useful for a bunch of cases. My case is doing something like GitHub - imjohnbo/ok-to-test: Example workflow configuration showing how to use GitHub Actions secrets in pull requests from forks 🍴🔑 - except I’d like to fix up the action shown in the PR so that it links to the action triggered by the ok-to-test command so that logs are easier to find.

👋 We have some documentation here: Getting started with the Checks API - GitHub Docs

The Checks API was built around GitHub Apps, so there’s a pretty tight coupling between Apps and Checks, more than just an authorization restriction.

I also ran into this limitation, when trying to create a secure way of receiving pull requests, following this:
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

My PR handler will store the files and the CI/CD will run on workflow_run.
If I don't register a check from the CI/CD workflow, the PR will look like everything has passed and the code (potentially malicious) can be approved. Checks works fine - but as other people have stated, details_url doesn't (apparently by design).

Too bad, but I will stop looking for solutions.