Permission denied when doing action

Hello,

I am trying to use this action to automatically generate a version using dunamai some automatic version generator. I try to use add and commit action to automatically commit the new version after each PR merge but it says that I don’t have the right. The goal is for anyone that merge a PR to trigger this action.

Error :

 Error: Error: Pushing to https://github.com/rlberry-py/rlberry
remote: Permission to rlberry-py/rlberry.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/rlberry-py/rlberry/': The requested URL returned error: 403

the action yml:

name: Version
on:
  pull_request:
    branches:
      - main
    types: [closed]

jobs:
  versionjob:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-python@v2
        with:
          python-version: '3.7'
      - uses: actions/checkout@v2
        with:
          # This is necessary so that we have the tags.
          fetch-depth: 0
      - uses: mtkennerly/dunamai-action@v1
        with:
          env-var: MY_VERSION
      - run: echo $MY_VERSION
      - run: echo "__version__ = \"$MY_VERSION \"" > rlberry/_version.py
      - uses: EndBug/add-and-commit@v8
        with:
          add: 'rlberry/_version.py'
          default_author: github_actor
          message: 'Writing version with github action'

Does anybody know what is wrong with my yml ? Do I have to use a token ?

Thanks

[TimotheeMathieu]

Indeed I did not have the rights. Solved using https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

[TimotheeMathieu]

I checked and it says “No branch protection rules defined yet.” in the settings of the repo. So I guess that’s a no, I am not really familiar with protected branches.