GoReleaser publish 403 Forbidden (token scope) in CI

By Kaveh Alemi·Latchkey

A 403 during publish means GoReleaser is authenticated but the token is not permitted to perform the action, such as uploading release assets or writing to the repository. The credential is valid; its scope is not.

What this error means

GoReleaser fails mid-publish with "403 Forbidden" or "Resource not accessible by integration" while creating the release or uploading an artifact.

⨯ release failed after 4s
  error=failed to upload dist/app_linux_amd64.tar.gz: PUT ...: 403 Forbidden
  {Message:Resource not accessible by integration}

Common causes

The workflow token is read-only

Without permissions: contents: write, the built-in GITHUB_TOKEN cannot create releases or upload assets, returning 403.

The PAT lacks the required scope

A personal access token missing repo (or fine-grained contents write) scope authenticates but is forbidden from writing.

How to fix it

Grant contents write to the job

Add the write permission so the default token can publish.

permissions:
  contents: write

Scope the PAT for external targets

1. Create a PAT with repo scope (or fine-grained contents write on the target repos).
2. Store it as a secret and pass it as GITHUB_TOKEN to GoReleaser.
3. Re-run the publish step.

env:
  GITHUB_TOKEN: ${{ secrets.GORELEASER_PAT }}

How to prevent it

• Grant least-privilege contents: write for standard releases.
• Use a scoped PAT for tap, formula, or bucket repos in other orgs.
• Audit token scopes when publish targets change.

Frequently asked questions

Related guides

References

• Go documentation
• GitHub Actions documentation