Windows "Access to the path is denied" in CI

Windows blocked a file operation for a permission reason. On a runner this is usually a read-only attribute, a path that is actually a directory, or a file another handle still owns.

What this error means

An IO operation fails with UnauthorizedAccessException. It is mostly deterministic, though a file briefly held by another process can make it look intermittent (see the file-in-use page).

Remove-Item : Access to the path 'C:\actions-runner\_work\repo\out\app.dll'
is denied.
At line:1 char:1
+ Remove-Item out/app.dll -Force
    + CategoryInfo          : PermissionDenied: (...app.dll:FileInfo) [Remove-Item], UnauthorizedAccessException
    + FullyQualifiedErrorId : RemoveFileSystemItemUnAuthorizedAccess

Common causes

The file is read-only

Files restored from some caches or checked out with a read-only attribute cannot be overwritten or deleted until the attribute is cleared.

A directory was passed where a file was expected

Get-Content or a stream open against a folder path raises access-denied rather than not-found, which can be misleading.

Insufficient permission on a protected location

Writing under Program Files or another system path needs elevation the runner step does not have.

How to fix it

Clear the read-only attribute before writing

Strip read-only across the tree, then perform the operation.

Get-ChildItem -Recurse out | ForEach-Object { $_.Attributes = 'Normal' }
Remove-Item out -Recurse -Force

Write to a path you control

Use the workspace or RUNNER_TEMP instead of a protected system directory.

$tmp = Join-Path $env:RUNNER_TEMP 'build'
New-Item -ItemType Directory -Force -Path $tmp | Out-Null

How to prevent it

• Keep build output under $GITHUB_WORKSPACE or $RUNNER_TEMP, and clear read-only attributes on cached or generated files before overwriting them.

Related guides