How to perform cross-organisation fork using GitHub App Integration

[dadepo]

Select Topic Area

Question

Body

Here is the scenario.

I have a GitHub app installed in org A and org B, and for each company I can successfully exchange the installation id for access token I can use to interact with their resources on GitHub.

Now I want to fork a private repository in org A into org B using the GitHub installation. ie do a cross-org forking.

From the create fork documentation here https://docs.github.com/en/rest/repos/forks?apiVersion=2022-11-28&versionId=free-pro-team%40latest&category=repos&subcategory=webhooks#create-a-fork it says

Although this endpoint works with GitHub Apps, the GitHub App must be installed on the destination account with access to all repositories and on the source account with access to the source repository.

I have the App installed in both the destination account and source but whenever I try to fork with it I get the error

{
"message": "Not Found",
"documentation_url": "https://docs.github.com/rest/repos/forks#create-a-fork",
"status": "404"
}

So it seems the documentation is wrong, and it is not possible to perform a cross-org forking using the GitHub App integration or I am doing it wrong?

[Aqib121201]

The most likely fix is to call the forks API with the installation token from the destination org, not the source org. For cross org forks, GitHub checks that the same App is installed on both orgs, but the authenticated installation has to be the one that will own the new fork. Using the source org’s installation token usually returns a 404 that masks a permissions issue.

Try this once with your Org B installation token and an explicit organization in the body. You should get a 202 response and see the new repo under Org B use the installation access token for ORG_B i have coded for you

export TOKEN=ghs_xxx_from_org_b_installation

curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/repos/ORG_A/SOURCE_REPO/forks \
  -d '{"organization":"ORG_B"}'

If that still returns 404, the next thing to check is policy and scopes. Make sure private forking is allowed in Org A and that cross-org forking isn’t blocked by the org or enterprise settings. Also confirm the App has at least contents:read on the source repo and is installed on Org B with permissions to create repositories there. If policy forbids it, use a bot account with a PAT that has access to both orgs and perform the fork from that account instead.

If this solved it, please mark the answer as helpful so others can find it.

[dadepo]

This worked when the source repo is public. But when it is private it does not work. Despite the fact that I have enabled forking of private repositories in the source organisation:

And also from what i can tell, the app is installed with all the required permissions