Can GITHUB_TOKEN bypass branch protection rules to push directly to a protected branch?
Select an answer to reveal the explanation.
Short Explanation and Infographic
By default GITHUB_TOKEN respects branch protection, but there's an admin setting to allow GitHub Actions to bypass — use with care.
Full explanation below image
Full Explanation
Branch protection rules apply to GITHUB_TOKEN by default. However, repository administrators can configure branch protection rules to allow bypass for GitHub Actions by checking 'Allow specified actors to bypass required pull requests' and adding 'GitHub Actions' as a bypass actor. This is sometimes needed for automated release commits or version bumps. Use this with extreme caution — it essentially creates a path to bypass your PR review requirements. The safer alternative is to use push protection that allows only specific, signed commits from verified workflows.