ERROR: Permission to org/repo.git denied to deploy key
ID: cicd/gha-deploy-key-permission
Version Compatibility
| Version | Status | Introduced | Deprecated | Notes |
|---|---|---|---|---|
| any | active | — | — | — |
Root Cause
Deploy key lacks write permission or is being used to access a second repository. GitHub deploy keys are read-only by default and each key can only be attached to a single repository, so push operations or cross-repo access will fail.
genericWorkarounds
-
94% success Re-add the deploy key with 'Allow write access' enabled in repository settings
Go to the repository Settings > Deploy keys, remove the existing read-only key, then add it again with the 'Allow write access' checkbox checked. This grants push permission for that single repository.
-
92% success Use a GitHub App installation token instead of a deploy key for cross-repo access
Create a GitHub App with the necessary repository permissions, install it on the required repos, and use actions like tibdex/github-app-token or peter-murray/workflow-application-token-action to generate an installation token at runtime. Use this token for git operations.
-
88% success Use webfactory/ssh-agent action with unique deploy keys per repository and SSH config aliases
Generate a unique SSH key pair for each repository. Store each private key as a separate secret. Use webfactory/[email protected] to load all keys, then configure ~/.ssh/config with Host aliases so git knows which key to use for each repo URL.
Dead Ends
Common approaches that don't work:
-
Add the same deploy key to a second repository for cross-repo access
99% fail
GitHub enforces that each SSH deploy key can only be registered to one repository. Attempting to add the same public key to another repo produces 'Key is already in use' error.
-
Re-generate the deploy key without enabling write access
85% fail
Regenerating the key pair does not help if 'Allow write access' is not checked when adding the new public key to the repository deploy key settings. The default is read-only.
-
Use ssh-agent with the deploy key and assume git push will work
95% fail
Loading the key into ssh-agent does not override GitHub's server-side read-only restriction. The push is rejected by the remote regardless of local SSH configuration.