actions/github-script "Resource not accessible by integration" (contents: write missing)

By Kaveh Alemi·Latchkey

github-script calls run as the GITHUB_TOKEN integration. When the workflow permissions block omits the scope the call needs, GitHub returns 403 "Resource not accessible by integration".

What this error means

A github-script write call (create a commit, tag, release asset, dispatch) fails with "Resource not accessible by integration".

RequestError [HttpError]: Resource not accessible by integration
    status: 403
##[error]Unhandled error: HttpError: Resource not accessible by integration

Common causes

Default read-only token

Repos with the default restricted token grant only contents: read, so any write API returns 403.

Missing the specific scope

Writing repo content needs contents: write; the scope for the resource being mutated was not declared.

How to fix it

Grant the scope the call needs

1. Add a permissions block at workflow or job level.
2. Set the exact scope to write (for example contents: write).
3. Re-run; the integration now has access.

permissions:
  contents: write
jobs:
  tag:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            await github.rest.git.createRef({
              ...context.repo,
              ref: 'refs/tags/v1.2.3',
              sha: context.sha,
            });

How to prevent it

• Declare a minimal permissions block per workflow and widen only the scope a step needs.
• Match the scope name to the resource: contents, issues, pull-requests, packages, etc.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions