HttpError: You do not have permission to create labels on this repository

[matejchalk]

Description:
The labeler action has just started failing with:

HttpError: You do not have permission to create labels on this repository.: {"resource":"Repository","field":"label","code":"unauthorized"}

Up until just now (May 14, 2025), the following workflow was working fine (see runs):

name: PR Labeler

on:
  pull_request_target:
    types: [opened, synchronize]

jobs:
  label:
    name: Add PR labels
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v4
      - uses: actions/labeler@v5
        with:
          repo-token: '${{ secrets.GITHUB_TOKEN }}'
          sync-labels: true

Action version:

v5

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Repro steps:

See PR code-pushup/cli#1006 with failing workflow.

Expected behavior:

Action should have permission to create labels, since the built-in GITHUB_TOKEN secret is being used and pull-requests: write permissions are configured.

Actual behavior:

Workflow fails with permissions error:

[RobertGernert-TomTom]

I could fix this in my workflows by adding the permission issues: write

[aparnajyothi-y]

Heloo @matejchalk, Thank you for creating this issue and we will look into it :)

[chiranjib-swain]

Hi @matejchalk ,
Following a recent test using a forked repository and pull request, I can confirm that the labeler is functioning correctly. While there were transient permission issues related to GITHUB_TOKEN observed on 2025-05-14, these did not persist in subsequent workflow runs.
For users who may still be encountering similar issues, I’d like to highlight two recommended approaches that can help ensure smooth labeler functionality:

1. Define Explicit Workflow Permissions
GitHub processes pull requests as issues internally, which means applying labels requires access to the Issues API. To enable this, your workflow must explicitly declare the necessary permissions. Be sure to include the following block in your workflow file:

permissions:
  contents: read
  pull-requests: write
  issues: write

This ensures the default GITHUB_TOKEN has sufficient access to apply and sync labels correctly.

2. Use a Fine-Grained Personal Access Token (Optional)
For enhanced control or scenarios where the default token scope is insufficient, you can use a fine-grained personal access token (PAT) with appropriate scopes (e.g., Issues or Pull requests with Read/Write access).
Store the PAT as a repository secret (e.g., PERSONAL_ACCESS_TOKEN), and reference it in your workflow like so:

      - uses: actions/labeler@v5
        with:
          repo-token: '${{ secrets.PERSONAL_ACCESS_TOKEN }}'
          sync-labels: true

I hope this helps clarify the setup for others. If you continue to face issues or need further assistance, feel free to reach out.
Thanks again to everyone for your collaboration and contributions in making this project better!

[matejchalk]

@chiranjib-swain Thanks for investigating this 🙂 It does indeed seem like it was a temporary problem, the labeler action has since been working just fine in our subsequent PRs, without any configuration changes on our end.