GoReleaser GITHUB_TOKEN 401 Bad credentials in CI

By Kaveh Alemi·Latchkey

GoReleaser authenticates to GitHub with GITHUB_TOKEN to create the release and upload assets. If the token is missing or not in the step env, the API returns 401 and the release fails.

What this error means

GoReleaser fails with "401 Bad credentials" or "GITHUB_TOKEN, GITLAB_TOKEN and GITEA_TOKEN are not set" when it tries to create the release.

⨯ release failed after 0s
  error=failed to create client: GITHUB_TOKEN, GITLAB_TOKEN and GITEA_TOKEN are not set

Common causes

The token is not exported to the GoReleaser step

The action needs GITHUB_TOKEN in its env; without it, GoReleaser has no credential and cannot call the API.

The token lacks contents: write permission

The default GITHUB_TOKEN may be read-only if the workflow does not grant contents: write, causing auth failures on release creation.

How to fix it

Pass the token and grant write permission

1. Add permissions: contents: write to the job or workflow.
2. Set GITHUB_TOKEN in the GoReleaser step env from the built-in secret.
3. Re-run so GoReleaser can authenticate and create the release.

permissions:
  contents: write
jobs:
  release:
    steps:
      - uses: goreleaser/goreleaser-action@v6
        with:
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Use a PAT for cross-repo pushes

If the release touches another repository (such as a tap), the built-in token is not enough; supply a personal access token with the needed scope.

env:
  GITHUB_TOKEN: ${{ secrets.GORELEASER_PAT }}

How to prevent it

• Always set GITHUB_TOKEN in the GoReleaser step env.
• Grant contents: write to the release job.
• Use a scoped PAT when releasing to external repositories.

Frequently asked questions

Related guides

References

• Go documentation
• GitHub Actions documentation