Can't create new release: EGITNOPERMISSION

[jwerre]

I run semantic-release from a workflow on other branches in the same repo and it works fine but when I run from the main base branch I get the following error:

✘  Failed step "fail" of plugin "@semantic-release/github"
✘  An error occurred while running semantic-release: RequestError [HttpError]: Resource not accessible by integration

Github returns a 403 'Resource not accessible by integration' and then.

 ✘  EGITNOPERMISSION Cannot push to the Git repository.
semantic-release cannot push the version tag to the branch main on the remote Git repository with URL https://x-access-token:[secure]@github.com

I think this has something to do with the fact that I'm publishing to Github Pages from this workflow and there is some kind of permissions issue. Could it be passing in a limited GITHUB_TOKEN because of this? Are there permissions I could set to resolve this? It's a difficult thing to debug so any help would be much appreciated.

workflow:

name: build

on:
    push:
        branches:
            - main
    # Allow this workflow to run manually from the Actions tab
    workflow_dispatch:

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
    contents: read
    pages: write
    id-token: write

# Allow one concurrent deployment
concurrency:
    group: 'pages'
    cancel-in-progress: true

env:
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

jobs:
    deploy:
        runs-on: ubuntu-latest

        environment:
            name: github-pages
            url: ${{ steps.deployment.outputs.page_url }}

        steps:
            - name: Checkout
              uses: actions/checkout@v3

            - name: Setup Pages
              uses: actions/configure-pages@v2

            - name: Setup Node.js
              uses: actions/setup-node@v3
              with:
                  node-version: 18

            - name: Install dependencies
              run: npm ci --ignore-scripts
              env:
                  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

            - name: Build
              run: npm run storybook:build

            - name: Upload artifact
              uses: actions/upload-pages-artifact@v1
              with:
                  path: './static'

            - name: Deploy to GitHub Pages
              id: deployment
              uses: actions/deploy-pages@v1

            - name: Package components
              run: npm run package

            - name: Publish to NPM
              run: npm run release
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.releaserc.yaml

branches:
    - main
    - next
    - next-major
    - name: beta
      prerelease: true
    - name: alpha
      prerelease: true
plugins:
    - '@semantic-release/commit-analyzer'
    - '@semantic-release/release-notes-generator'
    - '@semantic-release/changelog'
    - - '@semantic-release/npm'
      - pkgRoot: package
    - - '@semantic-release/github'
      - assets:
            - path: package
              label: components

[jwerre]

I added permissions: write-all to my workflow and that solved the issue. I'd like to have the least privilege possible. Does anyone know which of these I need?

permissions:
  actions: read|write|none
  checks: read|write|none
  contents: read|write|none
  deployments: read|write|none
  id-token: read|write|none
  issues: read|write|none
  discussions: read|write|none
  packages: read|write|none
  pages: read|write|none
  pull-requests: read|write|none
  repository-projects: read|write|none
  security-events: read|write|none
  statuses: read|write|none

[adriancmiranda]

Hey @jwerre! I hope it work for you

name: build

on:
    push:
        branches:
            - main
    # Allow this workflow to run manually from the Actions tab
    workflow_dispatch:

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
    contents: write
    pages: write
    id-token: write

# Allow one concurrent deployment
concurrency:
    group: 'pages'
    cancel-in-progress: true

env:
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

jobs:
    deploy:
        runs-on: ubuntu-latest

        environment:
            name: github-pages
            url: ${{ steps.deployment.outputs.page_url }}

        steps:
            - name: Checkout
              uses: actions/checkout@v3

            - name: Setup Pages
              uses: actions/configure-pages@v2

            - name: Setup Node.js
              uses: actions/setup-node@v3
              with:
                  node-version: 18

            - name: Install dependencies
              run: npm ci --ignore-scripts
              env:
                  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

            - name: Build
              run: npm run storybook:build

            - name: Upload artifact
              uses: actions/upload-pages-artifact@v1
              with:
                  path: './static'

            - name: Deploy to GitHub Pages
              id: deployment
              uses: actions/deploy-pages@v1

            - name: Package components
              run: npm run package

            - name: Publish to NPM
              run: |
                echo "${{github.repository_owner}}:registry=https://npm.pkg.github.com" >> .npmrc
                echo "//npm.pkg.github.com/:_authToken=${{secrets.GITHUB_TOKEN}}" >> .npmrc
                npm run release
              env:
                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

[travi]

the github plugin docs list the minimum: https://github.com/semantic-release/github#github-authentication