From be06a18aa7812d339089fde1c159f571cf2e0ae7 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Mon, 26 Oct 2026 14:41:50 -0500
Subject: [PATCH] push the bump branch with a PAT

GITHUB_TOKEN is a GitHub App installation token, so GitHub never grants
it the workflows permission, and it can't push commits touching
.github/workflows/*. The bump branch carries workflow-file changes (the
rust-just pin bumps), so push it with a fine-grained PAT, stored as
DWILDING_GITHUB_TOKEN in the personal-token environment. The PR is
created with GITHUB_TOKEN, so the reviewer request works.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/bump.yaml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/bump.yaml b/.github/workflows/bump.yaml
index 7af6a17..7d0570c 100644
--- a/.github/workflows/bump.yaml
+++ b/.github/workflows/bump.yaml
@@ -13,6 +13,7 @@ permissions: {}
 jobs:
   bump:
     runs-on: ubuntu-latest
+    environment: personal-token
     permissions:
       contents: write
       pull-requests: write
@@ -46,14 +47,19 @@ jobs:
             exit 0
           fi
           git commit -am "bump deps"
-      - name: Open a PR
+      - name: Push branch with elevated permissions
         env:
           VERSION: ${{ inputs.version }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.DWILDING_GITHUB_TOKEN }}  # Needs scope "Update GitHub Action workflows".
         run: |
           set -euo pipefail
           git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git push --force origin "bump-to-$VERSION"
+      - name: Open a PR
+        env:
+          VERSION: ${{ inputs.version }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
           gh pr create --base main --head "bump-to-$VERSION" \
             --title "chore: bump package to $VERSION" \
             --body "" \