Refusing to allow an OAuth App to create or update workflow #7251

jsok · 2023-03-30T00:37:32Z

jsok
Mar 30, 2023

Whenever I attempt to gh pr create which contains new workflows in .github/workflows I keep getting the above error.

 ! [remote rejected] HEAD -> my-branch (refusing to allow an OAuth App to create or update workflow `.github/workflows/build.yaml` without `workflow` scope)

I don't expect it to make a difference, but my PAT has workflow scope enabled on it. The Github OAuth App however doesn't appear to have this.
I've removed and re-installed the GitHub CLI app on my personal account but still to no luck.

Any insights on this? Issue search doesn't reveal anyone else having the problem 🤔

Answered by mislav

Apr 4, 2023

gh automatically requests the workflow scope during gh auth login if during the interactive login process you chose "Yes" to the question of whether to set up Git to authenticate with gh as a credential helper:

cli/pkg/cmd/auth/shared/git_credential.go

Lines 41 to 45 in 1263412

     if flow.shouldSetup {  
   if isGitMissing(gitErr) {  
   return gitErr  
   }  
   flow.scopes = append(flow.scopes, "workflow")  

 

View full answer

mislav · 2023-03-30T09:24:42Z

mislav
Mar 30, 2023

Hi, when you run gh auth status does it list the workflow scope?

$ gh auth status -h github.com
github.com
  ✓ Logged in to github.com as mislav (keyring)
  ✓ Git operations for github.com configured to use https protocol.
  ✓ Token: gho_************************************
  ✓ Token scopes: codespace, gist, notifications, read:discussion, read:org, repo, workflow

And if you try to manually push the git branch directly before opening a PR, does it work?

git push -u origin HEAD

3 replies

jsok Apr 3, 2023
Author

workflow is missing from token scopes:

Token scopes: admin:public_key, gist, read:org, repo

Seems gh auth login --scopes workflow is the fix here 🙌

Seems odd that this isn't a default scope when logging in? I mean, editing files in .github/workflows is something I'd expect many gh users to do?

mislav Apr 4, 2023

gh automatically requests the workflow scope during gh auth login if during the interactive login process you chose "Yes" to the question of whether to set up Git to authenticate with gh as a credential helper:

cli/pkg/cmd/auth/shared/git_credential.go

Lines 41 to 45 in 1263412

    
           if flow.shouldSetup { 
        
           	if isGitMissing(gitErr) { 
        
           		return gitErr 
        
           	} 
        
           	flow.scopes = append(flow.scopes, "workflow")