Not always working on private repos

[TheKnarf]

I made a repo that previously was public into private and one of my pipelines started failing on the checkout step. What was extra weird was that only one of two pipelines started failing.

The following continued working fine:

name: CI

on:
  push:

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: 'Tests'
    runs-on: ubuntu-latest
    steps:
      - name: 'Checking Out Code'
        uses: actions/checkout@v4

      - name: 'Installing Dependencies'
        uses: ./.github/actions/install

      - name: 'Running Unit Tests'
        run: pnpm test

  build:
    name: 'Builds'
    runs-on: ubuntu-latest
    steps:
      - name: 'Checking Out Code'
        uses: actions/checkout@v4

      - name: 'Installing Dependencies'
        uses: ./.github/actions/install

      - name: 'Building'
        run: pnpm build

But this one started failing:

name: CD Github Pages

on:
  push:
    branches:
      - main

jobs:
  deploy-github-pages:
    runs-on: ubuntu-latest

    # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
    permissions:
      pages: write      # to deploy to Pages
      id-token: write   # to verify the deployment originates from an appropriate source

    # Deploy to the github-pages environment
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    steps:
      - name: 'Checking Out Code'
        uses: actions/checkout@v4

      - name: 'Installing Dependencies'
        uses: ./.github/actions/install

      - name: 'Build'
        run: pnpm build
        env:
          URL: 'https://theknarf.com/'

      - name: 'upload'
        uses: actions/upload-pages-artifact@v3
        with:
          path: dist

      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4

[testersen]

Your deploy-github-pages job does not have permission to read the repository. When you specify the permissions property on a job, your job will deviate from the standard permissions. That means you must explicitly also enable contents: read on that workflow.