Fix: Properly handle workflow file modifications in releases

[adityamaru]

Problem

The previous fix incorrectly added workflows: write permission, which doesn't exist in GitHub Actions. The actual issue is that the default GITHUB_TOKEN cannot push changes to workflow files for security reasons.

Root Cause

When cherry-picking patches that modify workflow files, GitHub prevents the default token from pushing these changes with the error:

refusing to allow a GitHub App to create or update workflow 
without 'workflows' permission

Solution

1. Remove invalid permission: Removed the non-existent workflows: write permission
2. Use Personal Access Token: Modified both workflows to use WORKFLOW_TOKEN (if configured) or fall back to GITHUB_TOKEN
3. Add documentation: Added setup instructions in DEPLOYMENT.md

Setup Required

To handle patches that modify workflows:

1. Create a Personal Access Token with repo and workflow scopes
2. Add it as WORKFLOW_TOKEN secret in repository settings
3. The workflows will automatically use it when available

If no PAT is configured, the workflows will use GITHUB_TOKEN and work normally for patches that don't modify workflows.

Testing

• Without WORKFLOW_TOKEN: Works for regular patches
• With WORKFLOW_TOKEN: Can cherry-pick and push patches that modify workflow files

---

Note

Switch workflows to use WORKFLOW_TOKEN (falling back to GITHUB_TOKEN) and remove the invalid workflows: write permission; add PAT setup instructions to DEPLOYMENT.md.

• Workflows:
  • /.github/workflows/rebase-upstream.yml, /.github/workflows/release-patched-version.yml:
    • Use secrets.WORKFLOW_TOKEN || secrets.GITHUB_TOKEN for checkout token.
    • Remove invalid workflows: write permission.
• Docs:
  • DEPLOYMENT.md: Add Personal Access Token setup requirements and notes for handling workflow file changes.

^{Written by Cursor Bugbot for commit e6f0577. This will update automatically on new commits. Configure here.}