Routine for red or stuck workflow runs: read the failing step, enable debug logs, reproduce locally, and match the error against the usual suspects.
Open the run in the Actions tab and expand the first red step; read the last 20 lines
| Error | Cause / fix |
|---|---|
Resource not accessible by integration | GITHUB_TOKEN lacks a permission → add it in permissions: |
denied: permission_denied pushing to ghcr.io | Missing packages: write, or package not linked to this repo |
| Secret is empty | Misspelled name, wrong environment, or PR from a fork |
| Workflow never starts | YAML error (see Actions tab banner), path/branch filters, file not on the default branch for schedule/dispatch |
Not authorized to perform sts:AssumeRoleWithWebIdentity | Missing id-token: write or trust policy sub does not match repo/branch/environment |
| Job queued forever | No runner with that label (self-hosted offline, typo in runs-on) |
| Works locally, fails in CI | Different tool versions, missing env var, timezone/locale, no service container |
| Step killed at 6 h / exit 143 | Hung process → add timeout-minutes |