GitHub私有组织仓库中如何为GitHub Actions开启写入权限？

你遇到的remote: Write access to repository not granted.报错，核心原因是工作流文件里的全局权限配置覆盖了仓库级别的权限设置：

你的工作流开头设置了permissions: read-all，这会强制将所有Actions的权限锁定为只读，哪怕你在仓库设置里开启了“读取和写入权限”也会被这个配置覆盖。

修复步骤： #

• 将工作流中的permissions: read-all替换为需要的写入权限。因为你需要部署到deploy分支，至少需要contents的写入权限，修改后的配置如下：

permissions:
  contents: write

• 如果你只需要在部署步骤启用写入权限，也可以单独给该步骤配置权限，但全局设置更简洁直接。

修改后的完整工作流文件： #

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  workflow_dispatch:

name: bookdown

# 替换原read-all权限，设置contents为可写
permissions:
  contents: write

jobs:
  bookdown:
    runs-on: ubuntu-latest
    # Only restrict concurrency for non-PR jobs
    concurrency:
      group: pkgdown-${{ github.event_name != 'pull_request' || github.run_id }}
    env:
      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - uses: r-lib/actions/setup-pandoc@v2

      - uses: r-lib/actions/setup-tinytex@v2
      
      - uses: r-lib/actions/setup-r@v2
        with:
          use-public-rspm: true

      - uses: r-lib/actions/setup-renv@v2

      - name: Cache bookdown results
        uses: actions/cache@v4
        with:
          path: _bookdown_files
          key: bookdown-${{ hashFiles('**/*Rmd') }}
          restore-keys: bookdown-

      - name: Build site
        run: source("_render.R")
        shell: Rscript {0}

      - name: Deploy book 🚀
        if: github.event_name != 'pull_request'
        uses: JamesIves/github-pages-deploy-action@v4.5.0
        with:
          branch: deploy
          folder: _book

内容的提问来源于stack exchange，提问作者Jake Thompson