GitHub Actions "Permission to X denied to github-actions[bot]"

By Kaveh Alemi·Latchkey

A git push using the GITHUB_TOKEN was denied because the bot identity lacks write access. This is a permissions issue; a retry changes nothing.

What this error means

A push step fails with "remote: Permission to <owner>/<repo>.git denied to github-actions[bot]".

remote: Permission to octo/repo.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/octo/repo/': The requested URL returned error: 403

Common causes

contents permission not granted

Pushing commits needs contents: write, which the default token may not have.

Protected branch blocks the bot

Branch protection can forbid the bot from pushing even with contents write.

How to fix it

Grant contents write or use a PAT

1. Add permissions: contents: write to the job.
2. For protected branches, push via a PAT allowed to bypass protection.

permissions:
  contents: write

How to prevent it

• Decide up front whether CI should push, and grant the minimum scope.
• Exempt a dedicated automation identity from branch protection if pushes are required.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions