GitHub云企业版Actions Runner的PAT权限验证及故障排查

• 需验证GitHub云（非本地部署版本）企业级Actions Runner所需的PAT权限，官方相关文档未明确具体权限要求
• 使用仅配置manage_runners:enterprise权限、且已完成目标组织SSO授权的用户PAT，可正常触发WebHook并创建Runner，但任务始终无法分配至该Runner
• Runner标签为self-hosted，对企业内所有组织和工作流开放，且已在GitHub UI的Runner组列表中显示
• Pod监听约10分钟后出现访问拒绝错误，日志内容如下：

2022-08-12 20:09:39.810  DEBUG --- Runner successfully configured.
{
  "agentId": 204,
  "agentName": "ghrunner-ext-57zzb-qqvzc",
  "poolId": 5,
  "poolName": "test",
  "ephemeral": true,
  "serverUrl": "https://pipelines.actions.githubusercontent.com/fMYN...",
  "gitHubUrl": "https://github.com/enterprises/myorg",
  "workFolder": "/runner/_work"
2022-08-12 20:09:39.890  DEBUG --- Docker enabled runner detected and Docker daemon wait is enabled
2022-08-12 20:09:39.913  DEBUG --- Waiting until Docker is available or the timeout is reached
Cannot connect to the Docker daemon at tcp://localhost:2376. Is the docker daemon running?
}CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

√ Connected to GitHub


Current runner version: '2.295.0'
2022-08-12 18:45:13Z: Listening for Jobs
An error occurred: Access denied. System:ServiceIdentity;DDDDDDDD-DDDD-DDDD-DDDD-DDDDDDDDDDDD needs View permissions to perform the action.
Runner listener exit with retryable error, re-launch runner in 5 seconds.
Restarting runner...

√ Connected to GitHub

Failed to create a session. The runner registration has been deleted from the server, please re-configure.
Runner listener exit with terminated error, stop the service, no retry needed.
Exiting runner...

• 无法确定触发访问拒绝的具体操作，推测为GitHub权限问题，当前运行环境为AWS EKS，使用Actions helm版本0.25.2

内容的提问来源于stack exchange，提问作者Meli