GitHub CD流程中Personal Access Token无workflow权限报错求助

错误根源 #

这个错误的核心是你用于推送代码的Token没有workflow权限：

• GitHub默认的GITHUB_TOKEN没有修改仓库中workflow文件的权限，即使你的提交内容不是修改workflow，只要仓库存在.github/workflows/目录下的文件，推送时的Token必须具备workflow权限才能通过校验。
• 你创建的全权限PAT如果没有在工作流中正确配置使用，依然会使用默认的GITHUB_TOKEN导致报错。

修复方案 #

1. 确认PAT的workflow权限 #

• 进入GitHub个人设置 → Developer settings → Personal access tokens
• 找到你创建的PAT，确保Workflow权限设置为Read and write
• 将该PAT添加到仓库的Secrets中，命名为PAT_WITH_WORKFLOW

2. 修改工作流的checkout步骤 #

默认的actions/checkout会使用GITHUB_TOKEN，需要替换为你的PAT，确保后续git操作使用有权限的Token：

- uses: actions/checkout@v3
  with:
    token: ${{ secrets.PAT_WITH_WORKFLOW }}

3. 优化推送步骤（避免意外提交+明确指定Token） #

把原步骤中的git add .改为只添加目标文件，同时推送时明确使用你的PAT：

- name: Commit and push Dockerrun.aws.json
  run: |
    git config user.name github-actions
    git config user.email github-actions@github.com
    git add Dockerrun.aws.json
    git commit -m "Update Dockerrun.aws.json docker image with new tag ${{ steps.build-number.outputs.BUILD_NUMBER }}"
    git push https://${{ secrets.PAT_WITH_WORKFLOW }}@github.com/${{ github.repository }}.git

完整修改后的工作流示例 #

name: CD - Deploy Backend

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - backend/**

jobs:
  deploy:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./backend
    services:
      postgres:
        image: postgres:14.5
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: 123456789
          POSTGRES_DB: customer
        ports:
          - "5433:5432"
        options:
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@v3
        with:
          token: ${{ secrets.PAT_WITH_WORKFLOW }}
      - uses: actions/setup-java@v3
        with:
          distributions: "corretto"
          java-version: "17"
          cache: "maven"
      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{secrets.DOCKERHUB_USERNAME}}
          password: ${{secrets.DOCKERHUB_ACCESS_TOKEN}}
      - name: Set build number
        id: build-number
        run: echo "BUILD_NUMBER=$(date '+%d.%m.%Y.%H.%M.%S')" >> GITHUB_OUTPUT
      - name: Build Package Push with Maven
        run: mvn -ntp -B verify -D docker.image.tag=${{steps.build-number.outputs.BUILD_NUMBER}} jib:build
      - name: Update Dockerrun.aws.json api image tag with new build number
        run: |
          echo "Dockerrun.aws.json before updating tag"
          cat Dockerrun.aws.json
          sed -i -E 's_(ahmadmujtaba200210/fullstack:)([^"]*)_\1'${{ steps.build-number.outputs.BUILD_NUMBER }}'_' Dockerrun.aws.json
          echo "Dockerrun.aws.json after updating tag"
          cat Dockerrun.aws.json
      - name: Deploy to Elastic Beanstalk
        uses: einaregilsson/beanstalk-deploy@v21
        with:
          aws_access_key: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws_secret_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          application_name: ${{ secrets.EB_APPLICATION_NAME }}
          environment_name: ${{ secrets.EB_ENV_NAME }}
          version_label: ${{ steps.build-number.outputs.BUILD_NUMBER }}
          version_description: ${{github.SHA}}
          region: ${{ secrets.EB_REGION }}
          deployment_package: backend/Dockerrun.aws.json
      - name: Commit and push Dockerrun.aws.json
        run: |
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add Dockerrun.aws.json
          git commit -m "Update Dockerrun.aws.json docker image with new tag ${{ steps.build-number.outputs.BUILD_NUMBER }}"
          git push https://${{ secrets.PAT_WITH_WORKFLOW }}@github.com/${{ github.repository }}.git

额外注意事项 #

• 不要使用git add .，避免意外提交构建生成的文件（如target目录）
• 确认你的PAT未过期，且所属账号拥有仓库的写入权限
• 若使用组织仓库，需确认组织未限制PAT的权限范围

内容的提问来源于stack exchange，提问作者Ahmad Mujtaba