Frontmatter
| id | 9294 |
| title | Revert to PAT for cross-repo pages deployment to fix 403 error |
| state | Closed |
| labels | bugaibuild |
| assignees | tobiu |
| createdAt | Feb 24, 2026, 6:55 PM |
| updatedAt | Feb 24, 2026, 7:08 PM |
| githubUrl | https://github.com/neomjs/neo/issues/9294 |
| author | tobiu |
| commentsCount | 1 |
| parentIssue | null |
| subIssues | [] |
| subIssuesCompleted | 0 |
| subIssuesTotal | 0 |
| blockedBy | [] |
| blocking | [] |
| closedAt | Feb 24, 2026, 7:08 PM |
Revert to PAT for cross-repo pages deployment to fix 403 error
tobiu assigned to @tobiu on Feb 24, 2026, 7:08 PM

tobiu
Feb 24, 2026, 7:08 PM
Input from Gemini 3.1 Pro:
✦ I have reverted the cross-repository push logic back to using the
PAGES_DEPLOY_PATsecret, bypassing the defaultGITHUB_TOKENwhich does not grant cross-organization write access.The workflow now includes a guard clause
if [ -z "$PAGES_DEPLOY_PAT" ]that skips the push gracefully instead of throwing an error if the secret has not been configured in the repository yet.The fix has been rebased and pushed to
dev.
tobiu closed this issue on Feb 24, 2026, 7:08 PM
Problem
The DevIndex automated pipeline's new step to push the
users.jsonlfile to theneomjs/pagesrepository failed with a 403 Forbidden error:remote: Permission to neomjs/pages.git denied to github-actions[bot].This confirms that despite both repositories being in the same organization, the default
GITHUB_TOKENgenerated during theneoworkflow run does not have implicit cross-repository write access.Solution
Revert the token configuration in the
devindex-pipeline.ymlworkflow back to using a dedicated Personal Access Token (PAGES_DEPLOY_PAT).This PAT must be configured as a repository secret within the
neorepository and must belong to a user/bot account with write access to theneomjs/pagesrepository. A guard clause is also included to gracefully skip the push step if the secret is not defined, preventing the entire pipeline from failing.