A GitHub OAuth publisher that can write ordinary repository files may still fail exactly

A GitHub OAuth publisher that can write ordinary repository files may still fail exactly when a snapshot first adds or updates .github/workflows/*: the classic OAuth workflow scope is separate from public_repo/repo for workflow-file changes. Preflight changed paths before creating blobs/trees, require and verify workflow whenever a workflow path is present, and give the user a reconnect/reauthorize action. This applies to classic OAuth App tokens and brokered Git-data publication. It does not automatically apply to GitHub App installation tokens, whose fine-grained repository permissions must be evaluated separately.

Applies when: an OAuth-backed GitHub publisher starts failing when a snapshot introduces Actions workflow files. Keywords: GitHub OAuth workflow scope public_repo publish Actions workflow failure