workflows permission missing

[plastikfan]

seeing this error in github actions:

[main 11ab90c] chore(gh-actions): apply auto-check edits
 36 files changed, 72 insertions(+), 610 deletions(-)
 delete mode 100644 .github/workflows/auto-check-workflow.yml
 delete mode 100644 scripts/automate-checklist.go
 delete mode 100644 scripts/automate-checklist.sh
 rename src/locale/default/{arcadia.active.en-GB.json => goo.active.en-GB.json} (100%)
 rename src/locale/deploy/{arcadia.active.en-US.json => goo.active.en-US.json} (100%)
 rename src/locale/out/en-US/{arcadia.translate.en-US.json => goo.translate.en-US.json} (100%)
 rename test/data/l10n/{test.arcadia.active.en-US.json => test.goo.active.en-US.json} (78%)
To https://github.com/snivilised/goo
 ! [remote rejected] main -> main (refusing to allow a GitHub App to create or update workflow `.github/workflows/ci-workflow.yml` without `workflows` permission)
error: failed to push some refs to 'https://github.com/snivilised/goo'

When a repo is created from this template and the auto-check-workflow.yml is executed.

AI has suggested this as a solution:

To resolve the error refusing to allow a GitHub App to create or update workflow without 'workflows' permission, you must explicitly grant the workflows permission at the repository or organization level.

Fix the Error
Update Repository/Organization Settings:
Go to your repository or organization Settings → Actions → General.
Under Workflow permissions, select "Read and write permissions".
Click Save.
This enables the GITHUB_TOKEN to create or update workflow files like .github/workflows/ci-workflow.yml.
Alternative: Use a Personal Access Token (PAT): If you're using a PAT for authentication:
Go to Settings → Developer settings → Personal access tokens.
Regenerate or create a new token with the workflow scope.
Use this token in your git push or CI setup.
GitHub App Users: If using a GitHub App:
Go to the GitHub App settings.
Under Permissions, set Workflows to Read and write.
Reinstall the app to apply the updated permissions.
✅ Note: The actions: write permission in the workflow YAML is not sufficient for modifying workflow files. The workflows permission must be enabled in the repository/organization settings or granted via PAT/app.

Also see:

• GitHub Actions permissions - Graphite
• GitHub Actions Workflow Permissions - Ken Muse

[plastikfan]

We can't provide a universal solution for this problem, because the use of the PAT only works when the target repo is within the same organisation. The instruction is to define a PAT inside the organisation that is the owner of the template repo, in this case snivilised. This means we need 2 solutions:

1. When the target repo is within snivilised, we can use the PAT solution; the PAT will flow from the org to the new repo. In this scenario, the github action workflow auto-check-workflow.yml will be able to run automatically after the target repo is created.

2. When the target repo is not within snivilised, there is no way to run the automation. So instead the user has to follow a fixed set of instructions (to be documented). Essentially a pre-defined sequence of steps will be codified into a task 'autocheck', that the external user can run, then commit and push. This is the most friction-less way of implementing the required changes.

[plastikfan]

now we see this error:

Run git add .
  git add .
  if [ -n "$(git status --porcelain)" ]; then
    git commit -m "chore(repo): bootstrap repository"
    # Update remote URL to include PAT for push
    git remote set-url origin https://x-access-token:${ORG_PAT}@github.com/${GITHUB_REPOSITORY}.git
    git push origin HEAD:main
  else
    echo "No changes to commit"
  fi
  shell: /usr/bin/bash -e {0}
  env:
    ORG_PAT: 
[main 9d5b6ab] chore(repo): bootstrap repository
 36 files changed, 66 insertions(+), 599 deletions(-)
 delete mode 100644 .github/workflows/auto-check-workflow.yml
 delete mode 100644 scripts/automate-checklist.go
 delete mode 100644 scripts/automate-checklist.sh
 rename src/locale/default/{arcadia.active.en-GB.json => shoo.active.en-GB.json} (100%)
 rename src/locale/deploy/{arcadia.active.en-US.json => shoo.active.en-US.json} (100%)
 rename src/locale/out/en-US/{arcadia.translate.en-US.json => shoo.translate.en-US.json} (100%)
 rename test/data/l10n/{test.arcadia.active.en-US.json => test.shoo.active.en-US.json} (78%)
To https://github.com/snivilised/shoo.git
 ! [remote rejected] HEAD -> main (refusing to allow a GitHub App to create or update workflow `.github/workflows/ci-workflow.yml` without `workflows` permission)
error: failed to push some refs to 'https://github.com/snivilised/shoo.git'
Error: Process completed with exit code 1.

So the PAT is not working.

See:

• Github Actions to make changes to a file
• Can GitHub actions directly edit files in a repository?