GitHub Actions GITHUB_TOKEN permissions reset to read-only by default policy

By Daniel Zoghalchali·Latchkey

Repositories and organizations can set the default GITHUB_TOKEN permission to read-only. Workflows that do not explicitly request write scopes then get a read token and any write API call returns 403.

What this error means

A workflow that pushes, comments, or releases fails with 403 / resource not accessible because the token is read-only.

RequestError [HttpError]: Resource not accessible by integration (403)
The default workflow permissions are set to read-only for this repository.

Common causes

Default workflow permissions are read-only

The org/repo setting grants a read-only token unless the workflow asks for more.

No permissions block in the workflow

Without an explicit permissions key, the workflow inherits the restricted default.

How to fix it

Request the needed scopes in the workflow

1. Add a permissions block granting exactly the write scopes the job needs.
2. Scope it at the job level when only one job writes.

permissions:
  contents: write
  pull-requests: write

Adjust the default at the org/repo level if appropriate

1. In Settings > Actions > General, set default workflow permissions as needed.
2. Prefer per-workflow permissions over a broad default.

How to prevent it

• Always declare an explicit permissions block with least privilege.
• Do not rely on the org default for write operations.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions