Personal Access Tokens Can Be Limited From Viewing Public Apis Due to Organizational Settings

[MarvNC]

Select Topic Area

Bug

Body

I am trying to make an automation that will never expire. This automation simply accesses the releases page of a repository and downloads the latest version of a release. I would like to use a never-expiring personal access token for this project as I am likely to forget to update this token, but it seems that there is a bug with the permissions of these tokens.
Here are two example repositories I would like to access. With the first one, I can access it without issue but with the second, I get an error: Request failed for https://api.github.com returned code 403. Truncated server response: {"message":"`themoeway` forbids access via a personal access token (classic). Please use a GitHub App, OAuth App, or a personal access token with f...

It appears to be unintended behavior that an access token would be unable to access an API url that is already publicly accessible simply due to organizational settings.

https://api.github.com/repos/stephenmk/Jitendex/releases/latest
https://api.github.com/repos/themoeway/jmdict-yomitan/releases/latest

[babblebey]

I ran into this same issue and it got me wondering why an endpoint whose response can be publicly when you're not making an authenticated request, But you get limited when authenticated 😒

My setup uses "Classic Token" to request an org details from ORG endpoint at

https://api.github.com/orgs/jargonsdev

...but due to the organizational settings (that can be seen at Org -> Settings -> Personal Access Tokens Setting),

....I got limited with the error message below

 message: '`jargonsdev` forbids access via a personal access token (classic). Please use a GitHub App, OAuth App, or a personal access token with fine-grained permissions.',

I changed my tokens to "Fine-grained Token" and I got similar message just removing fine-grained token from the talk

message: '`jargonsdev` forbids access via a personal access token with fine-grained permissions. Please use a GitHub App, or an OAuth App.',

I want to assume that this behavior isn't intended.... But if it does, I'm curious to understand what the use-case is 🤔