To successfully upgrade Insiders and run a GitLab CI pipeline, which repo permissions should my PAT have?

[JuLeeAtPlanet]

When I try to upgrade or in my GitLab pipeline, I get the following error:

> pip install --upgrade git+https://${GH_TOKEN}@github.com/squidfunk/mkdocs-material-insiders.git
Collecting git+https://****@github.com/squidfunk/mkdocs-material-insiders.git
  Cloning https://****@github.com/squidfunk/mkdocs-material-insiders.git to /private/var/folders/48/fhkqgp2n7_q3vztw41t7y1wr0000gp/T/pip-req-build-r1w9l660
  Running command git clone --filter=blob:none --quiet 'https://****@github.com/squidfunk/mkdocs-material-insiders.git' /private/var/folders/48/fhkqgp2n7_q3vztw41t7y1wr0000gp/T/pip-req-build-r1w9l660
  remote: Write access to repository not granted.
  fatal: unable to access 'https://github.com/squidfunk/mkdocs-material-insiders.git/': The requested URL returned error: 403
  error: subprocess-exited-with-error

I've given the following permissions to the one forked repo:

Commit statuses -- Access: Read and write
Contents -- Access: Read and write
Issues -- Access: Read and write
Metadata -- Access: Read-only
Pull requests -- Access: Read and write

Questions about the section of the PAT settings:

1. is it sufficient to grant access to "Only select repositories" -- and add my fork of the mkdocs-materials-insiders?
2. Are there other permissions besides the 5 listed above that I'm missing?
3. Are the settings different if you are pip installing vs. forking?

Thanks!

[squidfunk]

Fine-grained access tokens are currently not supported. We're working on moving the repository to an organization, which will allow the new token format. In the time being, please use a classic access token.

[JuLeeAtPlanet]

What permissions should this classic token be granted? All "repo" and write:packages & read:packages?

Also, the GitLab CI pipeline is failing at this line in the requirements.txt file:

-e git+ssh://[email protected]/squidfunk/mkdocs-material-insiders.git@e3a7660961abf387b264a7d00c8db1c3d552edbe#egg=mkdocs_material

Should that be set to something else?

[squidfunk]

repo scope should be enough, as mentioned in our documentation.

-e git+ssh://[[email protected]](mailto:[email protected])/squidfunk/mkdocs-material-insiders.git@e3a7660961abf387b264a7d00c8db1c3d552edbe#egg=mkdocs_material

You have no access token set.