refusing to allow a GitHub App to create or update workflow

Question

I have a GitHub action that uses :

github_token: ${{ secrets.GITHUB_TOKEN }}

When I run it I get:

  ! [remote rejected]     tmp_upstream/master -> master (refusing to allow a GitHub App to create or update workflow `.github/workflows/build-images-workflow-run.yml` without `workflows` permission)
error: failed to push some refs to '***github.com/myname/repo'

https://docs.github.com/en/actions/reference/authentication-in-a-workflow explains that

GitHub automatically creates a GITHUB_TOKEN secret to use in your workflow. You can use the GITHUB_TOKEN to authenticate in a workflow run.

But I used the workflow and it didn't seem to create the token. I went to create a personal token and then tried to save it with the name GITHUB_TOKEN but it says that the name is invalid. How can I solve this?

personal token

When you created your token, did you tick the box to update workflows? — mnestorov
– mnestorov, Commented Mar 15, 2021 at 18:58
Similar question: github - How to resolve "refusing to allow an OAuth App to create or update workflow" on git push - Stack Overflow — user202729
– user202729, Commented Aug 17, 2021 at 5:01

bk2204 · Accepted Answer · 2021-03-15 19:00:30Z

7

In order to modify a workflow, a GitHub App, such as the one used for issuing tokens for GitHub Actions, requires the workflow scope. This is so that GitHub Apps you've added to your repository can't access the secrets in your repository without your permission. The token issued for GitHub Actions doesn't have this permission by default.

If you don't need to modify the workflow files, then you can just avoid modifying them and this will go away. If you do need to modify them, you can create an appropriately scoped PAT and store it under a name that doesn't start with GITHUB, say WORKFLOW_TOKEN. You can then adjust your action to say this:

github_token: ${{ secrets.WORKFLOW_TOKEN }}

answered Mar 15, 2021 at 19:00

bk2204

78.9k7 gold badges111 silver badges128 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

sony Over a year ago

to be honest I don't fully understand this according to Method 2 dev.to/dtinth/… I don't even need to do this and the token is created behind when the workflow is activated

bk2204 Over a year ago

Yes, GitHub Actions creates a token, but you cannot use that token to modify workflow files. If you create a differently named PAT or other token with the workflow scope, then you can modify those files.

sony Over a year ago

I don't want to modify a workflow. The workflow is there because I forked the project. I just want to execute the workflow. This workflow just sync the upstream into my fork. That is it.

bk2204 Over a year ago

If you're pushing data that contains the workflow files, you must have the workflow scope on your token, even if that data is normally just up in the main project.

mnestorov · Accepted Answer · 2021-03-15 18:59:59Z

3

When generating tokens, you need to give the correct permissions for the token. You have to tick the following checkbox, next to workflow in order to have update privileges.

answered Mar 15, 2021 at 18:59

mnestorov

4,6242 gold badges19 silver badges30 bronze badges

1 Comment

sony Over a year ago

to be honest I don't fully understand this according to Method 2 dev.to/dtinth/… I don't even need to do this and the token is created behind when the workflow is activated

JounQin · Accepted Answer · 2022-08-06 03:57:55Z

2

You need to set token input of actions/checkout

See also https://github.com/actions/checkout#usage

answered Aug 6, 2022 at 3:57

JounQin

298 bronze badges

Collectives™ on Stack Overflow

refusing to allow a GitHub App to create or update workflow

3 Answers 3

4 Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related