Permission denied to github-actions[bot] even though PAT has permission #26694

nickderobertis · 2022-04-30T12:04:07Z

nickderobertis
Apr 30, 2022

Hey all, I have an action where I am trying to push a change to the same repo. I am authenticating via personal access token (PAT).

For some reason on this repo, the action fails with:

Permission to nickderobertis/flexlate-dev-semantic-release-example.git denied to github-actions[bot]

I added some debugging to show the authentication state of the PAT. gh auth status shows I am properly logged in and a curl to Github’s API shows my PAT has the following permissions:

admin:org
admin:org_hook
admin:repo_hook
delete:packages
delete_repo
gist
read:user
repo
user:email
workflow
write:permissions

Also ls-remote is working fine on the repo so it seems to be a write access problem.

Meanwhile, on other repos, I have been able use the same code just fine. I previously had provided the same PAT to both repos, but I have also tried creating a new PAT and adding to the affected repo with no change in behavior.

I am guessing there must be something different about this repo that prevents access, but I’m not sure what it could be. I can’t find any difference in the settings.

Has anyone encountered this or have ideas on what to check? Thanks!

Answered by airtower-luna

Apr 30, 2022

I notice you don’t set the token in actions/checkout, and don’t opt-out of configuring the Authorization header with it either. The result is that your PAT is effectively ignored, the push works if the default GITHUB_TOKEN is allowed to push.

I assume either that’s the difference between your repositories, or the one with the issue has a branch branch protection rule that gets in the way.

View full answer

airtower-luna · 2022-04-30T14:12:17Z

airtower-luna
Apr 30, 2022

I notice you don’t set the token in actions/checkout, and don’t opt-out of configuring the Authorization header with it either. The result is that your PAT is effectively ignored, the push works if the default GITHUB_TOKEN is allowed to push.

I assume either that’s the difference between your repositories, or the one with the issue has a branch branch protection rule that gets in the way.

0 replies

nickderobertis · 2022-05-01T13:16:22Z

nickderobertis
May 1, 2022
Author

Thank you for pointing that out, this was exactly it! I added:

with:
  token: ${{ secrets.GH_TOKEN }}

to actions/checkout@v3 and it solved the issue. Still not sure why I didn’t need that on other repos, but I will update them all to do this now that I know it was not using the PAT.

0 replies

airtower-luna · 2022-05-01T13:38:29Z

airtower-luna
May 1, 2022

nickderobertis:

Still not sure why I didn’t need that on other repos

I can’t be sure, obviously, but the first thing that comes to mind: In the repository settings you can configure whether the GITHUB_TOKEN should have read-write or read-only access. Maybe that’s different between the repositories?

0 replies

nickderobertis · 2022-05-01T19:37:29Z

nickderobertis
May 1, 2022
Author

In the repository settings you can configure whether the GITHUB_TOKEN should have read-write or read-only access. Maybe that’s different between the repositories?

Ah, yes, that was the underlying reason. I have no idea how this setting got set differently on the repos as I haven’t touched it. But good to know, thanks so much for your help!

0 replies

Dj2chris · 2022-05-02T13:40:09Z

Dj2chris
May 2, 2022

Why does there have to be so many links

0 replies

yusukekuro · 2022-05-02T13:40:16Z

yusukekuro
May 2, 2022

Check your workflow permission in Settings > Actions > General .
To push a commit, workflow needs to have write permission.

  <a href="https://github.com/ad-m/github-push-action/issues/96#issuecomment-889984928" target="_blank" rel="noopener nofollow ugc">github.com/ad-m/github-push-action</a>

remote: Permission to git denied to github-actions[bot].

<div class="github-info">
  <div class="date">
    opened <span class="discourse-local-date" data-format="ll" data-date="2021-07-29" data-time="18:27:02" data-timezone="UTC">06:27PM - 29 Jul 21 UTC</span>
  </div>


  <div class="user">
    <a href="https://github.com/Shaquu" target="_blank" rel="noopener nofollow ugc">
      <img alt="Shaquu" src="https://user-images.githubusercontent.com/40115800/181099273-86bc3c76-709d-450f-9d9f-1a5b40eef615.jpeg" class="onebox-avatar-inline" width="20" height="20">
      Shaquu
    </a>
  </div>
</div>

<div class="labels">
</div>

Hi, I am trying to push changes but like you will see it fails due to some erro…rs.

Test run is here:
https://github.com/NRCHKB/node-red-contrib-homekit-docker/runs/3194895671?check_suite_focus=true

Error

Run ad-m/github-push-action@master
  with:
    github_token: ***
    branch: refs/pull/42/merge
    directory: .
Push to branch refs/pull/42/merge
remote: Permission to NRCHKB/node-red-contrib-homekit-docker.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/NRCHKB/node-red-contrib-homekit-docker.git/': The requested URL returned error: 403
Error: Invalid exit code: 128
    at ChildProcess.&lt;anonymous&gt; (/home/runner/work/_actions/ad-m/github-push-action/master/start.js:29:21)
    at ChildProcess.emit (events.js:210:5)
    at maybeClose (internal/child_process.js:1021:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:283:5) {
  code: 128
}
Error: Invalid exit code: 128
    at ChildProcess.&lt;anonymous&gt; (/home/runner/work/_actions/ad-m/github-push-action/master/start.js:29:21)
    at ChildProcess.emit (events.js:210:5)
    at maybeClose (internal/child_process.js:1021:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:283:5)

Part of the gh action:

  dependabot:
    #needs: [build]
    runs-on: ubuntu-latest
    if: ${{ github.actor == 'dependabot[bot]' }}
    steps:
      - uses: actions/setup-node@v2
        with:
          node-version: '14'
      - uses: actions/checkout@v2
        with:
          persist-credentials: false
          fetch-depth: 0
      - run: |
          git config user.name github-actions[bot]
          git config user.email github-actions[bot]@users.noreply.github.com
          npm version patch -m "[RELEASE] %s"
      - name: Push changes
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          branch: ${{ github.ref }}
      - uses: fastify/github-action-merge-dependabot@v2.1.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
```</span></p>
  </div>

  </article>

  <div class="onebox-metadata">
    
    
  </div>

  <div style="clear: both"></div>
</aside>

0 replies

yondr-agency-15 · 2023-04-07T08:20:18Z

yondr-agency-15
Apr 7, 2023

thanks to @yusukekuro, I found this option in the settings of my repo: Settings > Actions > General

But adding permissions to my .yml also worked, and I prefer it this way:

permissions:
  deployments: write
  contents: write
  statuses: write
  actions: write
  checks: read

Github permissions documentation

2 replies

nikk30-lilly May 7, 2023

the solution working for me

pz-max Nov 8, 2023

Yes, adding only the permission information to the deploy.yml helped
while keeping the organization "Read and Write permission" turned off

martimpassos · 2024-04-11T20:24:11Z

martimpassos
Apr 11, 2024

I'm facing the same error, however in my case I'm checking out a main repo with a submodule (using checkout@v4), then in another step making changes to this submodule and trying to push them. Here's the step:

- name: Commit and push changes
        env:
          PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
        run: |
          cd my-submodule
          git config user.name my-username
          git config user.email my-username@github.com
          git remote set-url origin https://x-access-token:${PERSONAL_ACCESS_TOKEN}@github.com/organization/submodule-repo.git
          git add .
          git commit -m "Auto updated data" && git push origin HEAD:main || echo "No changes to commit"
          cd ..
          git add my-submodule
          git commit -m "Auto updated submodule reference" && git push || echo "No changes to commit"

Any leads here?

1 reply

airtower-luna Apr 12, 2024

actions/checkout configures Git to use the token it uses in the Authorization header (see its readme), this takes priority over anything you put into the URL (which isn't good style anyway because the URL could leak more easily).

Try setting the authorization header in the submodule Git config instead.

martimpassos · 2024-04-12T14:07:01Z

martimpassos
Apr 12, 2024

Based on your answer I simply configured actions/checkout to use the PAT and it worked. I didn't realize the credentials persisted between steps, messing with persist-credentials could probably work too

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Community

Permission denied to github-actions[bot] even though PAT has permission #26694

{{title}}

Replies: 9 comments 3 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

remote: Permission to git denied to github-actions[bot].

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

Permission denied to github-actions[bot] even though PAT has permission #26694

Replies: 9 comments · 3 replies

nickderobertis May 1, 2022 Author

nickderobertis May 1, 2022 Author

Replies: 9 comments 3 replies

nickderobertis
May 1, 2022
Author

nickderobertis
May 1, 2022
Author