repo classic PAT scope not enough for push-to-fork

[scop]

Subject of the issue

I have a repo using push-to-fork, with a bot user PAT having (only) repo scope as documented it needs in https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#push-pull-request-branches-to-a-fork.

The first time the bot created a PR things went fine and the PR was merged.

However, the second time it was in process of creating one, it failed to apparently sync its own working branch with the upstream repo and errored out with

! [remote rejected] create-pull-request/patch -> create-pull-request/patch (refusing to allow a Personal Access Token to create or update workflow `.github/workflows/update-tools.yaml` without `workflow` scope)

The PR's the bot user creates do not change any files in .github/workflows files. However, after the first PR that had been created, some such files had changed in the upstream repo, and I believe this caused a failure because the bot was not allowed to sync its own existing branch where it works in with that, as it was preparing to file another PR.

I tried if setting delete-branch would have helped, but it did not. Adding the workflow scope to the bot user PAT (in addition to repo) did. (Aside, this is even if the bot user's repo has actions disabled, but I guess it's understandable.)

Steps to reproduce

Follow the trail of links in the subject above.

[scop]

Suggested PR in #3511.

On the other hand, I believe if this action was modified so that it would actually delete its working branch in push-to-fork mode instead of pushing whatever changes upstream might have to it, the issue would not trigger.

[peter-evans]

Hi @scop

Thanks for raising this issue.

On the other hand, I believe if this action was modified so that it would actually delete its working branch in push-to-fork mode instead of pushing whatever changes upstream might have to it, the issue would not trigger.

I think what is happening is that when there are changes on the upstream (base) then action effectively rebases the changes you are making onto that new commit graph. So when the branch is force pushed to the fork and it includes commits on the upstream that contain changes to the .github/workflows path, it raises this error. I'm fairly sure this is unavoidable by the action, and the correct approach is to add the workflow scope, as you have done.