Organization-scoped PAT with Workflow permissions not working

[reteps]

Select Topic Area

Question

Body

I cannot get past this error:

Run git remote set-url origin "https://***@github.com/sigpwny/websites.git/"
[main 6b16eff] chore: update workflow schedule
 1 file changed, 124 insertions(+)
 create mode 100644 .github/workflows/scheduled-pings.yml
To https://github.com/sigpwny/websites.git/
 ! [remote rejected] main -> main (refusing to allow a GitHub App to create or update workflow `.github/workflows/scheduled-pings.yml` without `workflows` permission)

See also: stefanzweifel/git-auto-commit-action#347

I have created a variety of PAT types, none of them work:

My settings allow for using a PAT in my organization:

I setup the PAT in my repo:

I use the PAT when I checkout the repo:

jobs:
  deploy:
    name: Deploy (sigpwny.com)
    runs-on: ubuntu-latest
    permissions:
      contents: write
      deployments: write
    steps:
      - name: Check out repository code
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.WORKFLOW_PAT }}
          submodules: true
          fetch-depth: 0

I then try many different ways of forcing it to use the PAT:

       - name: Save scheduled discord pings
       if: github.ref_name == github.event.repository.default_branch
       env:
         WORKFLOW_PAT: ${{ secrets.WORKFLOW_PAT }}
         GITHUB_TOKEN: ${{ secrets.WORKFLOW_PAT }}
       run: |
         git remote set-url origin "https://${{ secrets.WORKFLOW_PAT }}@github.com/sigpwny/websites.git/"
         git config user.name sigpwny-uiuc
         git config user.email [email protected]
         git add .github
         git commit -m "chore: update workflow schedule"
         git push origin main

What is going on?

[reteps]

Ok, I found my issue. I had a composite action between the points in which I commit and check out, that did another checkout.

checkout w/token
<composite action> checkout wo/token
push

failed. I removed the checkout from my composite action and now it succeeds