GITHUB_TOKEN "Permission to ... denied to github-actions[bot]" in CI

By Kaveh Alemi·Latchkey

The push was rejected because github-actions[bot], the identity behind GITHUB_TOKEN, is not allowed to write to that repository. Either contents: write is missing, or the push targets a repo the token does not cover.

What this error means

git push fails with "remote: Permission to OWNER/REPO.git denied to github-actions[bot]" and a 403, while reads worked.

remote: Permission to my-org/other-repo.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/my-org/other-repo/': The requested
URL returned error: 403

Common causes

GITHUB_TOKEN lacks contents: write

Without contents: write the bot can read but not push to its own repository.

The push targets another repository

GITHUB_TOKEN is scoped to the workflow's own repo; pushing to a different repo needs a PAT or app token with access there.

How to fix it

Grant contents: write for same-repo pushes

1. Add contents: write to the job permissions.
2. Confirm the remote is the workflow's own repository.
3. Re-run the push.

permissions:
  contents: write

Use a cross-repo token to push elsewhere

To push to a different repository, supply a PAT or app installation token that has write access to that repo.

- uses: actions/checkout@v4
  with:
    repository: my-org/other-repo
    token: ${{ secrets.CROSS_REPO_PAT }}

How to prevent it

• Grant contents: write for pushes to the workflow's own repo.
• Use a dedicated token with access for cross-repo pushes.
• Confirm the remote URL points at the intended repository.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions