Failed "Ansible porting guide creation" github workflow during Ansible 11.8.0 release

[anweshadas]

The "Ansible porting guide creation" github workflow failed during Ansible 11.8.0 release with the following error in the Push to the repo step.

 Run git push origin "${GIT_BRANCH}"
  git push origin "${GIT_BRANCH}"
  shell: /usr/bin/bash -e {0}
  env:
    GIT_BRANCH: release/porting-guide-11.8.0
    ANSIBLE_VERSION_FULL: 11.8.0
    CI_COMMIT_MESSAGE: Add the Ansible community 11.8.0 porting guide
    ANSIBLE_VERSION_MAJOR: 11
remote: Permission to ansible/ansible-documentation.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/ansible/ansible-documentation/': The requested URL returned error: 403
Error: Process completed with exit code 128.

https://github.com/ansible/ansible-documentation/actions/runs/16320818352/job/46097824372

[anweshadas]

I recreated the issue in the personal fork after changing the settings of the said personal fork identical to the ansible-documentation repo. Then, I updated the settings for Action from Read repository contents and packages permissions to Read and write permissions and the workflow managed to push to the git branch.

I propose to do the same settings change to ansible-documentation repository. @felixfontein @gotmax23

[felixfontein]

I don't think we should change the repo's settings. There are quite a few workflows running in this repo, and changing the settings might introduce security issues in other workflows.

I know too little about the security model of GHAs, so I can't say too much, but maybe it makes sense to change the PR creation to how it is done in other workflows in this repo (using the bot account).

[oraNod]

I concur with @felixfontein and don't think we should change permissions in the documentation repo.

Also I feel like this should be discussed at the DaWGs so everyone gets visibility, including @samccann and myself. Changes to the docs repo go beyond release management and require broader discussion with additional maintainers.

[anweshadas]

I was avoiding external actions in the original PR (121), as I found that there that actions/create-github-app-token@v2 is already being used in https://github.com/ansible/ansible-documentation/blob/devel/.github/workflows/reusable-pip-compile.yml, I will use the same action for this in a new PR.