Refusing to allow an OAuth App to create or update workflow #7251

jsok · 2023-03-30T00:37:32Z

jsok
Mar 30, 2023

Whenever I attempt to gh pr create which contains new workflows in .github/workflows I keep getting the above error.

 ! [remote rejected] HEAD -> my-branch (refusing to allow an OAuth App to create or update workflow `.github/workflows/build.yaml` without `workflow` scope)

I don't expect it to make a difference, but my PAT has workflow scope enabled on it. The Github OAuth App however doesn't appear to have this.
I've removed and re-installed the GitHub CLI app on my personal account but still to no luck.

Any insights on this? Issue search doesn't reveal anyone else having the problem 🤔

Answered by mislav

Apr 4, 2023

gh automatically requests the workflow scope during gh auth login if during the interactive login process you chose "Yes" to the question of whether to set up Git to authenticate with gh as a credential helper:

cli/pkg/cmd/auth/shared/git_credential.go

Lines 41 to 45 in 1263412

     if flow.shouldSetup {  
   if isGitMissing(gitErr) {  
   return gitErr  
   }  
   flow.scopes = append(flow.scopes, "workflow")  

 

View full answer

mislav · 2023-03-30T09:24:42Z

mislav
Mar 30, 2023

Hi, when you run gh auth status does it list the workflow scope?

$ gh auth status -h github.com
github.com
  ✓ Logged in to github.com as mislav (keyring)
  ✓ Git operations for github.com configured to use https protocol.
  ✓ Token: gho_************************************
  ✓ Token scopes: codespace, gist, notifications, read:discussion, read:org, repo, workflow

And if you try to manually push the git branch directly before opening a PR, does it work?

git push -u origin HEAD

2 replies

jsok Apr 3, 2023
Author

workflow is missing from token scopes:

Token scopes: admin:public_key, gist, read:org, repo

Seems gh auth login --scopes workflow is the fix here 🙌

Seems odd that this isn't a default scope when logging in? I mean, editing files in .github/workflows is something I'd expect many gh users to do?

mislav Apr 4, 2023

gh automatically requests the workflow scope during gh auth login if during the interactive login process you chose "Yes" to the question of whether to set up Git to authenticate with gh as a credential helper:

cli/pkg/cmd/auth/shared/git_credential.go

Lines 41 to 45 in 1263412

    
           if flow.shouldSetup { 
        
           	if isGitMissing(gitErr) { 
        
           		return gitErr 
        
           	} 
        
           	flow.scopes = append(flow.scopes, "workflow")

Answer selected by jsok

c0nsy · 2024-07-21T16:32:24Z

c0nsy
Jul 21, 2024

@jsok Thanks for your answer.

Anyone reading this, download github cli and run gh auth login --scopes workflow followed by git push --force-with-lease. Worked great!

2 replies

LuizMateuss Sep 2, 2024

I only run

gh auth login --scopes workflow

and it worked perfectly for me

Ravinduchathuranga Dec 7, 2025

this actually worked for me!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Refusing to allow an OAuth App to create or update workflow #7251

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

	if flow.shouldSetup {
	if isGitMissing(gitErr) {
	return gitErr
	}
	flow.scopes = append(flow.scopes, "workflow")

Refusing to allow an OAuth App to create or update workflow #7251

Uh oh!

jsok Mar 30, 2023

Replies: 2 comments · 4 replies

Uh oh!

mislav Mar 30, 2023

Uh oh!

jsok Apr 3, 2023 Author

Uh oh!

mislav Apr 4, 2023

Uh oh!

c0nsy Jul 21, 2024

Uh oh!

LuizMateuss Sep 2, 2024

Uh oh!

Ravinduchathuranga Dec 7, 2025

jsok
Mar 30, 2023

Replies: 2 comments 4 replies

mislav
Mar 30, 2023

jsok Apr 3, 2023
Author

c0nsy
Jul 21, 2024