# Git GITHUB_TOKEN "permission to ... denied" on push in CI

> Fix the GitHub Actions "Permission to org/repo.git denied to github-actions[bot]" push error, caused by the default GITHUB_TOKEN lacking contents write.

Source: https://latchkey.dev/learn/git/git-github-token-insufficient-permission-push-in-ci  
Updated: 2026-06-26

The automatic GITHUB_TOKEN defaults to limited permissions. A workflow that pushes commits or tags needs contents: write, otherwise the push is rejected with a 403 even though the token is valid.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes Git GITHUB_TOKEN "permission to ... denied" on push in CI?

There are 3 common causes: default token is read-only for contents, workflow does not request write permission, and branch protection blocks the bot. Repos or orgs with the restricted default permission give GITHUB_TOKEN read access, which cannot push.

### How do I fix Git GITHUB_TOKEN "permission to ... denied" on push in CI?

There are 2 fixes depending on which cause you have: grant write permission to the job and use a dedicated token for protected branches. Work through them in order, since the first is the most common.

### What does Git GITHUB_TOKEN "permission to ... denied" on push in CI actually mean?

A push from an Actions job fails with remote: Permission to org/repo.git denied to github-actions[bot] and HTTP 403.

### How do I stop Git GITHUB_TOKEN "permission to ... denied" on push in CI happening again?

Declare an explicit permissions block on workflows that push, granting only contents: write, and use a scoped App token for pushes to protected branches.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt