LearnNewsExamplesServices
Frontmatter
id9294
titleRevert to PAT for cross-repo pages deployment to fix 403 error
stateClosed
labels
bugaibuild
assigneestobiu
createdAtFeb 24, 2026, 6:55 PM
updatedAtFeb 24, 2026, 7:08 PM
githubUrlhttps://github.com/neomjs/neo/issues/9294
authortobiu
commentsCount1
parentIssuenull
subIssues[]
subIssuesCompleted0
subIssuesTotal0
blockedBy[]
blocking[]
closedAtFeb 24, 2026, 7:08 PM

Revert to PAT for cross-repo pages deployment to fix 403 error

Closed v12.0.0 bugaibuild
tobiu
tobiu commented on Feb 24, 2026, 6:55 PM

Problem

The DevIndex automated pipeline's new step to push the users.jsonl file to the neomjs/pages repository failed with a 403 Forbidden error: remote: Permission to neomjs/pages.git denied to github-actions[bot].

This confirms that despite both repositories being in the same organization, the default GITHUB_TOKEN generated during the neo workflow run does not have implicit cross-repository write access.

Solution

Revert the token configuration in the devindex-pipeline.yml workflow back to using a dedicated Personal Access Token (PAGES_DEPLOY_PAT).

This PAT must be configured as a repository secret within the neo repository and must belong to a user/bot account with write access to the neomjs/pages repository. A guard clause is also included to gracefully skip the push step if the secret is not defined, preventing the entire pipeline from failing.

tobiu added the bug label on Feb 24, 2026, 6:55 PM
tobiu added the ai label on Feb 24, 2026, 6:55 PM
tobiu added the build label on Feb 24, 2026, 6:55 PM
tobiu referenced in commit 82fb1cb - "build: Revert to PAT for cross-repo pages deployment to fix 403 error (#9294)" on Feb 24, 2026, 7:03 PM
tobiu assigned to @tobiu on Feb 24, 2026, 7:08 PM
tobiu
tobiu Feb 24, 2026, 7:08 PM

Input from Gemini 3.1 Pro:

✦ I have reverted the cross-repository push logic back to using the PAGES_DEPLOY_PAT secret, bypassing the default GITHUB_TOKEN which does not grant cross-organization write access.

The workflow now includes a guard clause if [ -z "$PAGES_DEPLOY_PAT" ] that skips the push gracefully instead of throwing an error if the secret has not been configured in the repository yet.

The fix has been rebased and pushed to dev.

tobiu closed this issue on Feb 24, 2026, 7:08 PM