Lesstep
GitHub Actions · GitHub Pages · Checked November 3, 2026

GitHub Actions: "not allowed to deploy to github-pages due to environment protection rules"

The deploy job never started. The github-pages environment keeps a list of the branches and tags that may deploy to it, and the ref this run started from is not on that list. The name in quotes is that ref. Add a rule for it in the environment's settings, or deploy from a ref the list already allows.

What it looks like

Branch "main" is not allowed to deploy to github-pages due to environment protection rules.
The deployment was rejected or didn't satisfy other protection rules.

Seeing what the environment allows

The list is under Settings, Environments, github-pages, Deployment branches and tags. Only repository admins can change it. Anyone who can read the repository can print it:

gh api repos/OWNER/REPO/environments/github-pages --jq .deployment_branch_policy
gh api repos/OWNER/REPO/environments/github-pages/deployment-branch-policies \
  --jq '.branch_policies[] | "\(.type) \(.name)"'
{"custom_branch_policies":true,"protected_branches":false}
branch main

custom_branch_policies is the setting Selected branches and tags, and the lines after it are its rules. protected_branches is Protected branches only (below).

A rule can be there without anyone adding it. GitHub's documentation: "If the environment is created from running implicit page builds (for example, from a branch or folder source), the source branch will be added as a protection rule to the environment." So a repository that once published from a branch keeps that branch as a rule after it moves to GitHub Actions. scatter_smooth's environment allowed main and gh-pages, and its deploy from the tag v0.2.2 was refused (#30).

1. Deploying from a tag or a release

MGUK-KERS-Simulator deploys Pages when a v* tag is pushed. All five tag runs on November 1, 2026 were refused, and each time the site went out through a manual run on main (#16). A site made from workshop-template hit the same thing on its first release, Tag "v0.1.0" (#167).

2. A rule for a branch you no longer use

In open-questions the nightly deploy ran on main while the environment allowed only master (#25). When the list names a branch you no longer deploy from, add a rule for the one you do and remove the old one.

3. Deploying from another branch

discipline deploys from develop, and every deploy from it was refused from October 4, 2026 on (#494). Running the workflow by hand on another branch (Run workflow, Use workflow from) is refused the same way. Each deployment replaces the whole site, so allow the one branch the site should come from rather than every branch that runs the workflow; with several allowed, the site shows whichever deployed last.

"Protected branches only"

With this setting, a branch can deploy if branch protection rules cover it; if no branch in the repository has any, every branch can deploy. The documentation adds that runs triggered by a tag with the same name as a protected branch cannot deploy. To deploy from tags, use Selected branches and tags with a tag rule as in 1.

Telling it apart

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

GitHub, GitHub Actions and GitHub Pages are trademarks of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc. or JetBrains.

More: "Get Pages site failed" · "Resource not accessible by integration" · "Invalid workflow file" · GitHub Actions plugins for IntelliJ IDEA compared · 日本語