Git GITHUB_TOKEN "permission to ... denied" on push in CI

By Kaveh Alemi·Latchkey

The automatic GITHUB_TOKEN defaults to limited permissions. A workflow that pushes commits or tags needs contents: write, otherwise the push is rejected with a 403 even though the token is valid.

What this error means

A push from an Actions job fails with remote: Permission to org/repo.git denied to github-actions[bot] and HTTP 403. Read operations succeed; only the push fails.

git

remote: Permission to org/repo.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/org/repo.git/': The requested URL returned error: 403

Diagnose it: depth, refs, or credentials?

Terminal

git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v

Common causes

Default token is read-only for contents

Repos or orgs with the restricted default permission give GITHUB_TOKEN read access, which cannot push.

Workflow does not request write permission

Without a permissions block granting contents: write, the job token cannot push commits or tags.

Branch protection blocks the bot

A protected branch requiring reviews or status checks rejects a direct push from the Actions bot.

How to fix it

Grant write permission to the job

Add a permissions block requesting contents: write.
Keep the rest least-privilege.

.github/workflows/release.yml

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest

Use a dedicated token for protected branches

Push with a PAT or App token that is allowed to bypass branch protection where appropriate.
Or target an unprotected branch and open a PR.

How to prevent it

Declare an explicit permissions block on workflows that push, granting only contents: write, and use a scoped App token for pushes to protected branches. This is a permissions issue, not transient, so a retry will not help.

Frequently asked questions

What causes Git GITHUB_TOKEN "permission to ... denied" on push in CI?

There are 3 common causes: default token is read-only for contents, workflow does not request write permission, and branch protection blocks the bot. Repos or orgs with the restricted default permission give GITHUB_TOKEN read access, which cannot push.

How do I fix Git GITHUB_TOKEN "permission to ... denied" on push in CI?

There are 2 fixes depending on which cause you have: grant write permission to the job and use a dedicated token for protected branches. Work through them in order, since the first is the most common.

What does Git GITHUB_TOKEN "permission to ... denied" on push in CI actually mean?

A push from an Actions job fails with remote: Permission to org/repo.git denied to github-actions[bot] and HTTP 403.

How do I stop Git GITHUB_TOKEN "permission to ... denied" on push in CI happening again?

Declare an explicit permissions block on workflows that push, granting only contents: write, and use a scoped App token for pushes to protected branches.