fix: overlay-promotion-bot 403 — REPO_ACCESS_TOKEN lacks push permission #1031

What

The overlay-promotion-bot (workflow) has been failing every 2-hour run since ~Sep 12 04:15 UTC. The sync + commit succeed, but git push --force origin overlay-promotion returns:

remote: Permission to harmoniqs/amicode.git denied to jack-champagne.
fatal: unable to access 'https://github.com/harmoniqs/amicode/': The requested URL returned error: 403

Latest failed run

Why

The REPO_ACCESS_TOKEN secret is a PAT belonging to jack-champagne. The token authenticates correctly (checkout, gh CLI calls work) but lacks push permission to harmoniqs/amicode. Likely cause: the PAT was created as a fine-grained token without contents: write, or it expired and was regenerated without re-authorizing the repo.

Impact

The bot cannot open overlay-promotion PRs. The overlay is currently stale — the fork's local/amicode has moved to 8f0f5d90 (includes the merged Shiki highlighting PR #339) but the overlay still tracks 6fa55b66. This is non-blocking (the extension works fine, the binary is built from the fork directly) but the drift will grow until the bot is fixed.

Fix

Regenerate or re-authorize the PAT so it has push access to harmoniqs/amicode:

• Classic PAT: needs repo scope → github.com/settings/tokens
• Fine-grained PAT: needs Contents: read+write and Pull requests: read+write on harmoniqs/amicode → github.com/settings/personal-access-tokens

Then update the secret:

gh secret set REPO_ACCESS_TOKEN --repo harmoniqs/amicode

Verify with a manual trigger:

gh workflow run overlay-promotion-bot --repo harmoniqs/amicode

Context: PR #1030 fixed the workflow to route this token correctly. The workflow code is fine — this is purely a token permission issue.