| name | workflow-push-rejection |
| description | Use when a git push is rejected with "refusing to allow ... to create or
update workflow `.github/workflows/...` without `workflow` scope", or when a
push fails citing workflow files or a missing `workflow` token scope.
|
| license | CC-BY-NC-SA-4.0 |
| metadata | {"copyright":"Caleb Cushing"} |
Workflow Push Rejection
An AI agent's token usually lacks the workflow scope, so a push whose commits
create or modify a file under .github/workflows/ is rejected:
! [remote rejected] <branch> -> <branch> (refusing to allow an OAuth App to create or update workflow `.github/workflows/...` without `workflow` scope)
This usually does not mean you intentionally edited a workflow file. The
common cause is a stale base: a dependency bot updated a workflow file on the
remote, and your branch is built on an older origin/develop, so your branch's
copy of that file is now behind the remote and the push looks like it modifies
a workflow file. Rule that out before concluding it is a scope limitation.
Fix the stale base first
- Fetch the latest remote state:
git fetch origin
- Check whether
origin/develop is ahead:
git log --oneline develop..origin/develop
- Merge the latest base into your branch:
git merge origin/develop
- Push again
Do not force push — it is unnecessary here and may be blocked by repository
rules.
When it is genuinely a workflow edit
If an up-to-date base still hits the rejection, you really are creating or
modifying a workflow file. The agent's token lacks the workflow scope, so a
human must make the change. When planning, mark workflow-file edits as
human-required tasks and structure the work so agent-managed steps proceed
independently. Only files under .github/workflows/ are restricted; YAML files
elsewhere are not.
