Add documentation for "Update GitHub Action workflows"

[jsoref]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps

What part(s) of the article would you like to see updated?

Something should explain that workflow or workflows (?!) isn't available via GITHUB_TOKEN and one needs to create a PAT or an OAUTH app (?).

Additional information

We had a job which created a change to a workflow file, it committed the change, and then it pushed to the github repository.

 ! [remote rejected] branch-name -> branch-name (refusing to allow a GitHub App to create or update workflow `.github/workflows/task.yml` without `workflows` permission)

Problems:

1. Searching docs.github.com for this doesn't lead anywhere helpful
   • https://docs.github.com/en?query=workflow+permissions
   • https://docs.github.com/en?query=%22workflow+permissions%22
   • https://docs.github.com/en?query=%22Update+GitHub+Action+workflows%22
2. The error mentions a workflows permission, and I've searched high and low and can't find it. I think it's actually a workflow permission (note the lack of an s) as listed in https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps#available-scopes

Refs:
https://github.community/t/refusing-to-allow-a-github-app-to-create-or-update-workflow-without-workflows-permission/182573 is an unofficial item and comes from the perspective of knowing one already wanted to use a PAT.

I'm coming from the perspective of using a GITHUB_TOKEN that I've customized and not understanding what the error is talking about because it isn't documented.

[lee-dohm]

The first document you link shows that the workflow permission is not included in any standard configuration of the GITHUB_TOKEN and the instructions on how to add more permissions to the GITHUB_TOKEN are included in that same document.