Pushing or opening a PR from a GitHub Actions workflow fails with 'refusing to allow a GitHub App to create or update workflow `.github/workflows/...` without `workflows` permission'. How do I fix it?

Cause: Changes to files under .github/workflows are treated as a special, sensitive write. The built-in GITHUB_TOKEN has no "workflows" permission scope at all (its permissions key lists scopes such as contents, pull-requests, id-token and so on, but not workflows), so a workflow that pushes a commit touching a workflow file with GITHUB_TOKEN is refused. The same message appears for a GitHub App installation token whose app lacks the repository permission "Workflows: write". Fix: 1. If the push does not really need to modify workflow files, exclude them: do not stage changes under .github/workflows (for example, check what "git status" shows before committing in the job). 2. If it must change them, use a credential that can: a GitHub App installation token where the app has the repository permission Workflows set to read and write (then accept the new permission on each installation), or a fine-grained personal access token with the Workflows write permission, stored as an encrypted secret. Prefer the App approach so the credential is short-lived and not tied to a person. 3. Pass that token to actions/checkout (token:) or to the git push step instead of the default GITHUB_TOKEN. 4. Keep the token's other permissions minimal and limit the repositories it is installed on. 5. Note that pushes made with GITHUB_TOKEN do not trigger further workflow runs; using an App token or PAT also solves that side effect when it is wanted. Verify: re-run the job; the push or PR creation succeeds and the commit appears with the workflow file change. Sources: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax https://docs.github.com/en/actions/concepts/security/github_token https://docs.github.com/en/rest/overview/permissions-required-for-github-apps