A workflow can build tests but receives HTTP 403 when attempting to upload an artifact from a forked pull request. The goal is to restore the intended workflow while preserving original files, permissions and recovery options.
Recognize the exact symptom
Observed behavior: A workflow can build tests but receives HTTP 403 when attempting to upload an artifact from a forked pull request. Record the exact app or device build, affected account or file, and the first time this happened. A screenshot of the error state or a short log excerpt is useful when it contains no sensitive information.
Control comparison: Check event type, fork security restrictions and the effective GITHUB_TOKEN permissions separately from repository secrets. Keep the account, file, network and hardware unchanged wherever the comparison permits. If the control works, the difference between the two paths is your most useful clue.
- Does this reproduce every attempt, or only after a reboot, resume, update or account switch?
- Can the affected action complete through another supported route without changing the original data?
- Is the problem limited to one file, one profile, one device or every user of the service?
Why a controlled comparison matters
Separate permission, runtime, network and version failures from the application symptom. An environment-specific error should be reproduced under the same dependency versions.
Focused investigation: Inspect job permissions and artifact service error details; distinguish an action compatibility error from restricted fork execution. Treat this as a way to test a cause, not proof that the cause has already been established.
| What you observe | What to check next |
|---|---|
| The controlled comparison succeeds | Compare the settings, permissions or content specific to the failing path. |
| Both original and control fail | Check the shared device, account, network or service dependencies before changing the application. |
| It works only after a fresh start | Inspect background processes, cache state, session expiry or a reconnect sequence. |
Keep your data safe
Run diagnostics only in projects and systems you administer. Save the relevant configuration, secrets must stay out of logs, and test changes in a non-production environment first.
Save the current configuration, note its values, and use a harmless test item where possible. Avoid combining this repair with unrelated updates. In particular, Do not use pull_request_target with untrusted checkout code to bypass security restrictions.
Choose Beginner for reversible checks or Advanced for targeted diagnostics. A workflow can build tests but receives HTTP 403 when attempting to upload an artifact from a forked pull request. Confirm the affected product, user account, file or device, then record the time and a screenshot without private account information. This is the baseline; do not change settings yet. Check event type, fork security restrictions and the effective GITHUB_TOKEN permissions separately from repository secrets. Perform the comparison with one harmless test item. Write down both the successful and failing paths so that the next action targets the actual difference. Use the supported upload-artifact action and store safe build output without elevating pull-request permissions; adjust workflow design through reviewed repository settings. Change one setting or workflow at a time. Preserve an easy route back to the previous configuration and allow any synchronization, indexing or activation step to complete before retesting. A test workflow from an authorized branch uploads its permitted artifact, and fork workflows remain least-privileged. Test the original failing situation rather than an unrelated feature. If it passes, repeat after one normal restart or reconnect; if it fails, restore temporary diagnostic settings and use the Advanced track. Inspect job permissions and artifact service error details; distinguish an action compatibility error from restricted fork execution. Note which component provides the first observable failure. Avoid logging secrets, account recovery keys, authentication cookies or the contents of private documents. Use the least invasive diagnostic appropriate to GitHub Actions Artifact Upload Returns 403 for a Forked Pull Request. Compare the result with the supported control path: Check event type, fork security restrictions and the effective GITHUB_TOKEN permissions separately from repository secrets. If there are policy restrictions, involve the administrator rather than bypassing them. Use the supported upload-artifact action and store safe build output without elevating pull-request permissions; adjust workflow design through reviewed repository settings. Tie any configuration change to a specific observation. If the result is ambiguous, collect additional evidence instead of layering new resets onto an unexplained problem. A test workflow from an authorized branch uploads its permitted artifact, and fork workflows remain least-privileged. If this does not pass, reverse temporary changes. Safety limit: Do not use pull_request_target with untrusted checkout code to bypass security restrictions. Provide support with the error text, environment version and reproducible comparison; do not submit private tokens or user data.Step-by-Step Troubleshooting
Capture the exact symptom
Use a supported comparison
Apply the narrow repair
Test the original workflow
Establish the failing boundary
Collect focused diagnostics
permissions: contents: readValidate the likely cause
Restore and escalate safely
Solution Checklist
Risky assumptions
- Do not use pull_request_target with untrusted checkout code to bypass security restrictions.
- Do not treat a successful unrelated feature as evidence that the failing action is fixed; run the original comparison again.
- Do not erase logs, synced files or working credentials before you know which layer was responsible.
Prove the fix
Pass condition: A test workflow from an authorized branch uploads its permitted artifact, and fork workflows remain least-privileged. Repeat the same test using the original account, document, peripheral or network path; a passing test on a substitute is useful evidence but is not the final result.
For intermittent problems, repeat the operation after a normal application restart and again after the state change that originally triggered it, such as reconnecting a dock, signing in, or resuming from sleep. Check for new errors in the same location as the original symptom.
If the symptom remains
If the controlled test still fails, return temporary settings to their earlier state and collect the minimum relevant evidence. Next diagnostic: Inspect job permissions and artifact service error details; distinguish an action compatibility error from restricted fork execution. Note exactly which comparison failed and what changed after the attempted repair.
For managed devices, privacy-sensitive files, damaged storage or account security concerns, escalate to the responsible administrator or vendor with timestamps and non-sensitive logs rather than attempting a broad reset.
Maintenance notes
Pin critical tool versions where appropriate, review permissions in code and preserve non-production reproduction instructions for future failures.
When the system is stable, record the specific working change: Use the supported upload-artifact action and store safe build output without elevating pull-request permissions; adjust workflow design through reviewed repository settings. Keep this as a reversible troubleshooting record so a later upgrade does not require repeating unrelated repair attempts.
Official Resources
For product-specific procedures and limitations, consult GitHub Docs — Pull-request events and fork permissions.
Disqus hosts the discussion. Comments load automatically as you approach this section and may use cookies.