GitHub Actions: refusing to allow an OAuth App to create or update workflow

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# Personal access token: add the workflow scope alongside repo
# Fine grained tokens need Workflows: read and write

# gh CLI
gh auth refresh -h github.com -s workflow

# Inside Actions, the default GITHUB_TOKEN cannot push workflow changes.
# Use a PAT or an App token in a secret:
- uses: actions/checkout@v4
  with:
    token: ${{ secrets.WORKFLOW_PAT }}

# Prefer a GitHub App installation token over a long lived PAT

How to diagnose CI/CD errors

CI failures that do not reproduce locally are almost always about environment, permissions or resource limits rather than about your code. CI runners have less memory than a laptop, a deliberately restricted token, a clean cache, and often a different CPU architecture. Treating a CI failure as a code bug before checking those four things wastes an enormous amount of time.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Re-run the job with debug logging enabled (ACTIONS_STEP_DEBUG=true in GitHub Actions, CI_DEBUG_TRACE in GitLab). The default log deliberately hides the most useful lines.
2. Print the environment early: env | sort, node -v, free -m, df -h. Half of all "works on my machine" CI bugs are visible in that output.
3. Check token permissions explicitly. GitHub's GITHUB_TOKEN defaults to read-only in many organisations and produces the misleading Resource not accessible by integration error.
4. Remember that secrets are not available to workflows triggered by pull requests from forks. This is a security feature, not a misconfiguration.
5. Reproduce locally in the same container image the runner uses, rather than on your host, before changing pipeline configuration.

Tools worth reaching for

• ACTIONS_STEP_DEBUG
• act (local Actions runner)
• docker run <runner image>
• free -m / df -h in-job

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 docs.github.com

Related CI/CD errors

• Bazel: no such target / no such packageA label does not resolve: the package has no BUILD file, the target name is wrong, or it is…
• Bitbucket Pipelines: Memory limit exceededThe pipeline step exceeded the allocated memory (default 4GB). The build process or tests…
• CircleCI: Container ran out of memoryBuild process exceeded container memory limit. Need larger resource class or Optimise build.
• GitHub Actions: Failed to save cache (unable to reserve cache)Two concurrent jobs tried to save the same cache key, or the repository is at its 10 GB cache…
• GitHub Actions: Invalid workflow file, unexpected valueThe workflow failed schema validation before any job started. Usually an indentation slip…
• GitHub Actions: OIDC token request failed (not authorized)The workflow tried to exchange a GitHub OIDC token for cloud credentials but was refused…
• GitHub Actions: Resource not accessible by integrationWorkflow on fork PR lacks permission to access secrets or write operations.
• GitHub Actions: Secret not available in fork PRsSecrets are not passed to workflows triggered by pull requests from forks for security reasons.

See all 18 CI/CD errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.