Problems with the updatecli action: creating pull request: GitHub Actions is not permitted to create or approve pull requests

[kastl-ars]

Dear all,

am currently trying to get the helm chart guide running. I have a manifest that is working locally (in dry-run mode).

I cannot get it working in Github Actions however and I do not find the error. I assume I misunderstood some part of the documentation or copy&pasted something improperly.

TL;DR: The dry-run works, but during apply only the branch gets created, but not the pull request.

I already opened up an issue in the action's repository, but wanted to ask for help here, too, as it seem this might be due to some mismatch between the action's configuration and my updatecli manifest.

• Thescm part of the manifest is here
• The action part is here
• The github workflow for running updatecli is here

As you can see, the workflow gets the pull-requests: write permissions and the GITHUB_TOKEN is handed over to updatecli via the UPDATECLI_GITHUB_TOKEN environment variable.

A branch is being created, but no pull request. If the error message is genuine and not misleading, this indicates a permission mismatch.

Unfortunately I do not find any hint in the updatecli documentation as well as in the Github Actions documentation.

Any ideas, anyone?

Kind Regards,
Johannes

[AnkanMisra]

Your workflow-level permissions look correct. This error is most likely coming from a separate repository setting rather than the Updatecli manifest.

Go to Repository Settings → Actions → General → Workflow permissions and enable Allow GitHub Actions to create and approve pull requests.

The contents: write permission explains why Updatecli can create and push the branch. The pull-requests: write permission gives the token the required PR API permission, but it cannot override that repository-level restriction. GitHub disables PR creation by Actions by default for new personal repositories.

After enabling the setting, rerun the apply job. If the option is disabled or unavailable because an organization or enterprise policy controls it, an administrator will need to change that policy; otherwise, use a GitHub App or PAT with the required repository permissions.

GitHub documents the separate setting here: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests

[kastl-ars]

Thanks for the answer, I'll give that a try. If this is the issue, then this should be included in both the updatecli and updatecli-action documentation, right? Because just having the permissions in the workflow is not enough and this will hit many users...

[kastl-ars]

This seems to do the trick. I had to manually remove the leftover branch, otherwise the action just runs and does not create a PR. But after deletion of the branch I got a new branch and a new PR.

Thanks for your help!

[AnkanMisra]

Nice, glad that was it. And yeah, I agree—the docs should call out both pieces: pull-requests: write in the workflow and the repository-level toggle, since either one missing prevents PR creation. The stale branch behavior is worth noting too. Thanks for confirming!

[kastl-ars]

For the action I already opened an issue, I will create one for the updatecli docs, too.

[kastl-ars]

Repository Settings → Actions → General → Workflow permissions and enable Allow GitHub Actions to create and approve pull requests

updatecli/website#3627