`refusing to allow an OAuth App to create or update workflow` を解決する #GitHub

遭遇したエラー

ある日突然
refusing to allow an OAuth App to create or update workflow .github/workflows/hoge-action.ymlwithoutworkflow scope

エラー全文

Enumerating objects: 33, done.
Counting objects: 100% (33/33), done.
Delta compression using up to 16 threads
Compressing objects: 100% (21/21), done.
Writing objects: 100% (24/24), 1.17 MiB | 2.97 MiB/s, done.
Total 24 (delta 15), reused 5 (delta 1)
remote: Resolving deltas: 100% (15/15), completed with 8 local objects.
To https://github.com/hoge/moge.git
 ! [remote rejected]       0/foo -> 0/bar (refusing to allow an OAuth App to create or update workflow `.github/workflows/hoge-action.yml` without `workflow` scope)
error: failed to push some refs to 'https://github.com/hoge/moge.git'

解決方法

やること

今回は workflow の権限が足りなかったので

gh auth refresh -s workflow

なぜ

push に使っている権限に workflow が許可されていなかった
gh auth を使って権限を付与する

$ gh auth refresh --help
Expand or fix the permission scopes for stored credentials.

The `--scopes` flag accepts a comma separated list of scopes you want
your gh credentials to have. If no scopes are provided, the command
maintains previously added scopes.

The `--remove-scopes` flag accepts a comma separated list of scopes you
want to remove from your gh credentials. Scope removal is idempotent.
The minimum set of scopes (`repo`, `read:org`, and `gist`) cannot be removed.

The `--reset-scopes` flag resets the scopes for your gh credentials to
the default set of scopes for your auth flow.


USAGE
  gh auth refresh [flags]

FLAGS
  -h, --hostname string         The GitHub host to use for authentication
      --insecure-storage        Save authentication credentials in plain text instead of credential store
  -r, --remove-scopes strings   Authentication scopes to remove from gh
      --reset-scopes            Reset authentication scopes to the default minimum set of scopes
  -s, --scopes strings          Additional authentication scopes for gh to have

INHERITED FLAGS
  --help   Show help for command

EXAMPLES
  $ gh auth refresh --scopes write:org,read:public_key
  # => open a browser to add write:org and read:public_key scopes
  
  $ gh auth refresh
  # => open a browser to ensure your authentication credentials have the correct minimum scopes
  
  $ gh auth refresh --remove-scopes delete_repo
  # => open a browser to idempotently remove the delete_repo scope
  
  $ gh auth refresh --reset-scopes
  # => open a browser to re-authenticate with the default minimum scopes

参考

ref: https://github.com/cli/cli/issues/5355#issuecomment-1367157797