关于refusing to allow a GitHub App to create or update workflow `.github/workflows/XXXX.yml` without `workflows` permission

[maboloshi]

A: 在通过github action修改仓库时 遇到"refusing to allow a GitHub App to create or update workflow .github/workflows/rating-chart.yml without workflows permission"报错

Q: 根据提示可知, GitHub App 没有workflow权限.

1. 该github action有操作仓库.github/workflows/*的动作;
2. 该github action的授权操作可能只用了默认的${{ secrets.GITHUB_TOKEN }}或者没有赋予workflow权限的个人令牌, 而该GITHUB_TOKEN或个人令牌存在权限问题, 先来看一下官方对GITHUB_TOKEN的用法和权限说明

About the GITHUB_TOKEN secret

GitHub automatically creates a GITHUB_TOKEN secret to use in your workflow. You can use the GITHUB_TOKEN to authenticate in a workflow run.

When you enable GitHub Actions, GitHub installs a GitHub App on your repository. The GITHUB_TOKEN secret is a GitHub App installation access token. You can use the installation access token to authenticate on behalf of the GitHub App installed on your repository. The token's permissions are limited to the repository that contains your workflow. For more information, see "Permissions for the GITHUB_TOKEN."

from About the GITHUB_TOKEN secret

Permissions for the GITHUB_TOKEN

Permission	Access type	Access by forked repos
actions	read/write	read
checks	read/write	read
contents	read/write	read
deployments	read/write	read
issues	read/write	read
metadata	read	read
packages	read/write	read
pull requests	read/write	read
repository projects	read/write	read
statuses	read/write	read

解决办法:

If you need a token that requires permissions that aren't available in the GITHUB_TOKEN, you can create a personal access token and set it as a secret in your repository:

1. Use or create a token with the appropriate permissions for that repository. For more information, see "Creating a personal access token."
2. Add the token as a secret in your workflow's repository, and refer to it using the ${{ secrets.SECRET_NAME }} syntax. For more information, see "[Creating and using encrypted secrets](https://docs.github.com/en/free-pro-team@latest/github/automating-you

此处需要额外勾选workflow权限, 才能操作.github/workflows/*

类似案例:

• https://github.com/EndBug/add-and-commit/issues/52