[BUG]: github_app_installation_repository fails with 403 using GitHub App auth after upgrading from v6.12.1 to v6.13.0

[MarkPorohnja]

Expected Behavior

Terraform plan should succeed with provider v6.13.0, as it did with v6.12.1, when using GitHub App authentication to manage a github_app_installation_repository resource.

The resource should either:

1. continue to work with the same GitHub App authentication setup that worked in v6.12.1, or
2. return a clearer provider-side error if this authentication mode is no longer supported for this resource.

Actual Behavior

After upgrading the integrations/github provider from v6.12.1 to v6.13.0, terraform plan fails during refresh/read of github_app_installation_repository with:

Error: GET https://api.github.com/user/installations/{redacted}/repositories?per_page=100: 403 Resource not accessible by integration []

The same configuration succeeds after downgrading the provider back to v6.12.1.

The provider is authenticated using an enterprise GitHub App with broad permissions. This Terraform GitHub App is used to manage GitHub Enterprise/org resources, including adjusting repository access for another GitHub App installation.

Terraform Version

Terraform v1.15.8
on linux_amd64

provider registry.terraform.io/integrations/github:

• works: v6.12.1
• fails: v6.13.0

GitHub Installation Type

• GitHub.com (Free, Pro, or Team)
• GitHub Enterprise Server (on-premises)
• GitHub Enterprise Cloud with Personal Accounts (github.com)
• GitHub Enterprise Cloud with Managed Users/EMU (github.com)
• GitHub Enterprise Cloud with Data Residency (*.ghe.com)
• I don't know

Affected Resource(s)

• github_app_installation_repository

Terraform Configuration Files

terraform {
  required_version = "~> 1.14"
  required_providers {
    github = {
      source  = "integrations/github"
      version = "~> 6.0" # later was changed to "6.12.1"
    }
  }

  backend "azurerm" {
    ...redacted...
  }
}

variable "org_name" {
  type    = string
  default = "redacted"
}

provider "github" {
  owner = var.org_name
  app_auth {
    installation_id = "redacted"
  }
}

Steps to Reproduce

1. Configure the GitHub provider using GitHub App authentication.

   provider "github" {
     owner = var.github_owner

     app_auth {
       id              = var.github_app_id
       installation_id = var.github_app_installation_id
       pem_file        = var.github_app_private_key
     }
   }

2. Define a github_app_installation_repository resource that manages repository access for another GitHub App installation.

   resource "github_app_installation_repository" "gh_app_repo" {
     installation_id = var.target_github_app_installation_id
     repository      = var.repository_name
   }

3. Pin provider version to v6.12.1.

   terraform {
     required_providers {
       github = {
         source  = "integrations/github"
         version = "= 6.12.1"
       }
     }
   }

4. Run:

   terraform init -upgrade
   terraform plan

   Result: plan succeeds.

5. Change only the provider version to v6.13.0.

   terraform {
     required_providers {
       github = {
         source  = "integrations/github"
         version = "= 6.13.0"
       }
     }
   }

6. Run:

   terraform init -upgrade
   terraform plan

   Result: plan fails with:

   Error: GET https://api.github.com/user/installations/{redacted}/repositories?per_page=100: 403 Resource not accessible by integration []

Debug Output

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi, and thank you for opening this issue!

This repo is maintained by GitHub and community members on a best-effort basis. We'll get to this as soon as we can.

You can help us prioritize by adding details, reproduction steps, or a 👍 to issues that matter to you, and by joining the discussion on open issues and PRs.

---

_{🤖 This is an automated message.}

[hpedrorodrigues]

I use PAT in a few modules and am also hitting this same issue.

[deiga]

Hi @MarkPorohnja @hpedrorodrigues

Sorry to hear that you are having issues with this!
We need some help to investigate this. Could you provide the full output of TF_LOG=DEBUG terraform plan?

[alexvanderberkel]

Could it be that the end point is not suited for a GitHub?

https://docs.github.com/en/rest/apps/apps?apiVersion=2026-03-10#get-an-installation-for-the-authenticated-app

curl -L \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/app/installations

where the endpoint here is pointing to user in instead of app

https://api.github.com/user/installations/{redacted}/repositories?per_page=100

https://api.github.com/user/installations/app/installations/{installation_id}