`git commit` in Github Actions workflow failing: Write access to repository not granted, 403

Question

I have a .NET Core API project and using a GitHub workflow to build and deploy. I am using a GitHub Action to bump the version in .csproj upon each commit to the dev branch. To this point, it works fine.

When I try to commit the updated .csproj file, I get the error:

remote: Write access to repository not granted.
fatal: unable access 'https:/github/<repo>': The requested URL returned error: 403

I have confirmed that the Workflow permission for the repo are "Read and write permissions":

This is the workflow yaml:

jobs:
  build:
    runs-on: windows-latest
    permissions:
      contents: read #This is required for actions/checkout

    steps:
      - name: 'Support longpaths'
        run: git config --system core.longpaths true
    
      - uses: actions/checkout@v4

      - name: Set up .NET Core
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.x'

      - name:  Bump MyProject.Api version
        id: update
        uses: vers-one/[email protected]
        with:
          file: "./server/MyProject.Api/MyProject.Api.csproj"
          version: bump-build

### THE ERROR IS FROM THIS COMMIT ###
      - run: |
          git config user.name github-actions
          git config user.email [email protected]
          git add "./server/MyProject.Api/MyProject.Api.csproj"
          git commit -m "Update project versions to ${{ steps.update.outputs.newVersion }}"
          git push

      - name: Build with dotnet
        run: dotnet build --configuration Development
        working-directory: ./server

This workflow is running in the repo owner account, so it's not a collaborator permission issue.

I have searched and tried several recommendations, but it's still not working. Why might this not be working and how I can fix it?

Answer 1

The permissions in you workflow are stricter than the global ones, namely this part:

jobs:
  build:
    runs-on: windows-latest
    permissions:
      contents: read #This is required for actions/checkout

You can either remove the permissions section (unadvised) or change to contents: write (as commit is writing to your repository). Read more about permissions here