# Definig permissions/token on organization repos

**URL:** <https://forum.gitea.com/t/definig-permissions-token-on-organization-repos/10403>\
**Category:** Gitea Usages\
**Created:** [January 10, 2025, 11:35am UTC](https://forum.gitea.com/t/definig-permissions-token-on-organization-repos/10403 "2025-01-10T11:35:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![spf](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@spf](https://forum.gitea.com/u/spf)\
**Post date:** [January 10, 2025, 11:35am UTC](https://forum.gitea.com/t/definig-permissions-token-on-organization-repos/10403/1 "2025-01-10T11:35:44Z")

</div>

Hi,

I am confused with access control and permissions management on repos.

For now, as the owner and admin of a local Gitea instance, I have created an organization. For testing purposes it has been setup as “public”.

Inside, I have created several repos, with default settings.

On my user profile, I have created an Access Token (GITEA\_TOKEN) granting all permissions on everything.

One of the repos (REPO\_A) contains configuration files, generated by scripts located in another repo (REPO\_B).

I have defined a workflow in REPO\_B which is supposed to :

- checkout the scripts (from REPO\_B)
- checkout the static files (from REPO\_A) in a another dir (tmp\_dir)
- run the scripts against “tmp\_dir” content
- commit the results back into REPO\_A if needed

```auto
- name: Checkout Scripts files
  uses: actions/checkout@v4
  with:
    ref: main
    path: .
    persist-credentials: false

- name: Checkout remote static files
  uses: actions/checkout@v4
  with:
    ref: main
    repository: REPO_A/STATIC_FILES
    path: ./tmp_dir
    token: ${{ secrets.GITEA_TOKEN }}

    ...

    - name: Commit Docker related files if needed
      run: |
        cd ${GITHUB_WORKSPACE}/tmp_dir
        git status
        git add .
        git config user.name "${{ github.actor }}"
        git config user.email "${{ github.actor }}@nowhere.com"
        git diff --quiet && git diff --staged --quiet \
        || (git commit -m "generated by Gitea [${{ gitea.actor }}]" \
        && git push )

```

Everything is running fine until it’s time to commit, as I get an error 403 (remote: User permission denied).

I made my first experiments with repos located in my own worspace, the same code was working flawlessly.

So what am I missing ? I have not been able to find a permissions control interface and my access token seems to allow everything everywhere.

I have tried to remove the token in the workflow definition, use “github.token” instead, but nothing improves.

So I am running out of ideas …

Thanks for any help

Regards

---

<div class="post-metadata">

**Author:** ![spf](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@spf](https://forum.gitea.com/u/spf)\
**Post date:** [January 10, 2025, 4:13pm UTC](https://forum.gitea.com/t/definig-permissions-token-on-organization-repos/10403/2 "2025-01-10T16:13:20Z")

</div>

I have realized I am not passing any token with my shell commands.

So I have tried this approach :

```auto
     - name: Commit Docker related files if needed
       run: |
         cd ${GITHUB_WORKSPACE}/docker_tmp
         git remote -v
         new_remote_origin="$( echo $(git remote -v | grep push) | awk '{print $2}' | sed 's/:\/\//:\/\/${{ secrets.GITEA_TOKEN }}@/g' )"
         git remote set-url origin ${new_remote_origin}
         git remote -v
         git status
         git add .
         git config user.name "${{ github.actor }}"
         git config user.email "${{ github.actor }}@nowhere.com"
         git diff --quiet && git diff --staged --quiet \
         || (git commit -m "generated by Gitea [${{ gitea.actor }}]" \
         && git push )

```

But it’s not getting a better result.

And one last attempt before leaving it 🙂

```auto
        - name: Commit Docker related files if needed
          uses: stefanzweifel/git-auto-commit-action@v5
          with:
            repository: ./docker_tmp
            commit_message: "generated by Gitea [${{ gitea.actor }}]"

```

Guess what ? Same result.

I have also created a new team I am a member of, with admin permissions, but no improvements either.