How to Fix Permission denied to github-actions[bot] (GitHub Actions)

Quick Answer: The 'Permission denied to github-actions[bot]' error occurs when the default GITHUB_TOKEN lacks necessary permissions for a repository action. The fastest fix is to explicitly grant write permissions to the GITHUB_TOKEN in your workflow file using `permissions: write-all` or specific scopes like `contents: write`.

What Causes This Error

Insufficient GITHUB_TOKEN permissions in the workflow YAML.
Repository settings restricting GITHUB_TOKEN write access.
Branch protection rules preventing pushes by bots.
Incorrect 'on' trigger configuration for the workflow.
Using a personal access token (PAT) with insufficient scopes instead of GITHUB_TOKEN.

Step-by-Step Fixes

Fix 1: Grant write permissions to GITHUB_TOKEN in workflow

Open your `.github/workflows/your-workflow.yml` file.,Add or modify the `permissions` block at the job or workflow level.,To grant all write permissions, add: `permissions: write-all`,To grant specific write permissions (e.g., for pushing code), add: `permissions: contents: write`,Example at workflow level: ```yaml name: CI on: push permissions: contents: write jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: echo "Hello" ```,Commit and push the changes to your repository.

Fix 2: Adjust repository GITHUB_TOKEN permissions

Navigate to your repository on GitHub.,Go to 'Settings' > 'Actions' > 'General'.,Under 'Workflow permissions', ensure 'Read and write permissions' is selected.,Click 'Save'.

Fix 3: Review branch protection rules

Navigate to your repository on GitHub.,Go to 'Settings' > 'Branches'.,Locate the branch protection rule for the target branch (e.g., `main` or `master`).,Click 'Edit'.,Check if 'Require signed commits' or other rules are preventing bot pushes. If 'Require signed commits' is enabled, the `github-actions[bot]` cannot push directly. Consider alternative approaches like creating a pull request or using a PAT if direct pushes are unavoidable.,Adjust rules as necessary or disable 'Require signed commits' if it's the root cause and acceptable for your workflow.

Fix 4: Use a Personal Access Token (PAT) for specific cases

Generate a new PAT with `repo` scope (or more specific scopes like `public_repo`, `write:packages`) under 'Settings' > 'Developer settings' > 'Personal access tokens' > 'Tokens (classic)'.,Add the PAT as a repository secret (e.g., `GH_PAT`) under 'Settings' > 'Secrets and variables' > 'Actions' > 'Repository secrets'.,In your workflow, use the PAT instead of the default `GITHUB_TOKEN` for commands requiring higher permissions. Be aware that using a PAT will attribute commits to the user who owns the PAT, not `github-actions[bot]`.,Example: ```yaml - name: Push changes with PAT run: | git config user.name github-actions[bot] git config user.email github-actions[bot]@users.noreply.github.com git add . git commit -m "Automated update" git push https://${{ secrets.GH_PAT }}@github.com/${{ github.repository }}.git HEAD:main ```

Advanced Fixes

Advanced Fix 1: Advanced Fix: Granting Specific Permissions to a Job

Locate the specific job in your workflow YAML file that requires elevated permissions.,Add a `permissions` block directly under the job definition, specifying the required scopes. For example, to allow writing to the contents and creating pull requests:,```yaml jobs: build: runs-on: ubuntu-latest permissions: contents: write pull-requests: write steps: - uses: actions/checkout@v4 - name: Your action requiring write permissions run: | # Commands that need write access ```,Commit and push the changes to your workflow file.

Advanced Fix 2: Advanced Fix: Adjusting Repository-Level Default Permissions

Navigate to your repository on GitHub.,Go to 'Settings' > 'Actions' > 'General'.,Under 'Workflow permissions', select 'Read and write permissions' if your workflows frequently require write access across the repository.,Click 'Save' to apply the changes. Note that this sets the default for all workflows; specific workflow or job permissions can still override this.

Advanced Fix 3: Advanced Fix: Using a Personal Access Token (PAT) for External Resources (Use with Caution)

Generate a Personal Access Token (PAT) with the necessary scopes (e.g., `repo`, `write:packages`) on your GitHub account (Settings > Developer settings > Personal access tokens).,Add this PAT as a repository secret (Settings > Secrets and variables > Actions > New repository secret). Name it something descriptive, like `MY_PAT`.,In your workflow, reference this secret. For example, to push to a different repository or publish a package:,```yaml jobs: publish: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Publish with PAT run: | git config --global user.email "action@github.com" git config --global user.name "GitHub Action" git remote set-url origin https://x-access-token:${{ secrets.MY_PAT }}@github.com/${{ github.repository }} git push origin HEAD:main ```,**Warning:** Using PATs bypasses the `GITHUB_TOKEN`'s limited scope and can grant broad access. Use PATs only when `GITHUB_TOKEN` is insufficient and ensure the PAT has the absolute minimum required scopes.