title: Github Actions Runners Enterprise PAT permissions
body: <p>Has anyone verified what PAT permissions work for Github Actions for Github cloud Enterprise runners?<br />
  Specifically <a href="https://github.com" rel="nofollow noreferrer">https://github.com</a>, not the on-prem option.</p>
  <p><a href="https://github.com/actions-runner-controller/actions-runner-controller#deploying-using-pat-authentication" rel="nofollow noreferrer">https://github.com/actions-runner-controller/actions-runner-controller#deploying-using-pat-authentication</a><br />
  This article indicates it may not be certain exactly what perms are needed.</p>
  <p>I have a user PAT with (manage_runners:enterprise) as the only permission.  It also has SSO authorization on the org the actions are running on.</p>
  <p>It is correctly triggering the webhook and creating a runner, but <strong>never assigns the task to the runner</strong>.  The label match is just &quot;self-hosted&quot;, and the runners are open to all orgs and all workflows in the enterprise.</p>
  <p>I can see the runner show up in the runner groups list in github ui.</p>
  <p>The pod 'listens' for about ten minutes, then this is the access denied error I am seeing in the Pod Logs before it terminates and basically gives up.</p>
  <pre><code>2022-08-12 20:09:39.810  DEBUG --- Runner successfully configured.
  {
    &quot;agentId&quot;: 204,
    &quot;agentName&quot;: &quot;ghrunner-ext-57zzb-qqvzc&quot;,
    &quot;poolId&quot;: 5,
    &quot;poolName&quot;: &quot;test&quot;,
    &quot;ephemeral&quot;: true,
    &quot;serverUrl&quot;: &quot;https://pipelines.actions.githubusercontent.com/fMYN...&quot;,
    &quot;gitHubUrl&quot;: &quot;https://github.com/enterprises/myorg&quot;,
    &quot;workFolder&quot;: &quot;/runner/_work&quot;
  2022-08-12 20:09:39.890  DEBUG --- Docker enabled runner detected and Docker daemon wait is enabled
  2022-08-12 20:09:39.913  DEBUG --- Waiting until Docker is available or the timeout is reached
  Cannot connect to the Docker daemon at tcp://localhost:2376. Is the docker daemon running?
  }CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
  
  √ Connected to GitHub
  
  
  Current runner version: '2.295.0'
  2022-08-12 18:45:13Z: Listening for Jobs
  An error occurred: Access denied. System:ServiceIdentity;DDDDDDDD-DDDD-DDDD-DDDD-DDDDDDDDDDDD needs View permissions to perform the action.
  Runner listener exit with retryable error, re-launch runner in 5 seconds.
  Restarting runner...
  
  √ Connected to GitHub
  
  Failed to create a session. The runner registration has been deleted from the server, please re-configure.
  Runner listener exit with terminated error, stop the service, no retry needed.
  Exiting runner...
  </code></pre>
  <p>I can't tell what it's even trying to do that it is denied for.  I'm guessing this is a Github permission error.</p>
  <p>Running Actions helm version 0.25.2 in AWS EKS.</p>