Unable to push tag with GitHub Actions GITHUB_TOKEN: refusing to allow a GitHub App to create or update workflow .github/workflows/foo.yaml without workflows permission
#151442
Replies: 5 comments 6 replies
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
|
Log archive from workflow run where this issue was reproduced: logs_34393488059.zip |
Beta Was this translation helpful? Give feedback.
-
|
(for personal reference) opened GitHub support ticket: https://support.github.com/ticket/3233575 |
Beta Was this translation helpful? Give feedback.
-
|
Nice one, well found! I've hit this restriction too, you helped me get to the root cause and confirm it in my own situation. |
Beta Was this translation helpful? Give feedback.
-
|
Also running into this 🙂 https://github.com/maplibre/maplibre-native/actions/runs/21000150176/job/60368493041 What is the workaround? |
Beta Was this translation helpful? Give feedback.

Uh oh!
There was an error while loading. Please reload this page.
-
Select Topic Area
Bug
Body
It is not possible to push a git tag from GitHub Actions using the
GITHUB_TOKENif the tag points to a commit where the contents of.github/workflows/are not identical to the contents of.github/workflows/on the latest commit of any branchWhen pushing the tag, the workflow will fail with
If the contents of
.github/workflows/is identical to the contents of.github/workflows/on the latest commit of any branch, the tag will be pushed successfullyI understand why this protection is in place for branch pushes (you don't want a GitHub App creating a workflow that gives itself access to secrets). However, it appears this protection is being incorrectly applied to tag pushes
To clarify, the tag that is being pushed points to a commit that is already on the
mainbranch—it is just not the latest commit on themainbranch. Pushing the tag does not create or update a workflowIt appears that several people have run into this issue before, but may have misunderstood the root cause. For example:
actions/checkout#1421
https://github.com/orgs/community/discussions/109715
https://github.com/orgs/community/discussions/51520
https://github.com/orgs/community/discussions/146011
https://github.com/orgs/community/discussions/35410
https://github.com/orgs/community/discussions/141159
Steps to reproduce
.github/workflows/foo.yamltomainwith this content:mainbranchmaine.g.
Here is a repository created with those steps to reproduce: https://github.com/carlcsaposs-canonical/bug-report-github-actions-tags
Beta Was this translation helpful? Give feedback.
All reactions