Add `workflow` OAuth scope so the MCP can manage `.github/workflows/*.yml`

[NextLevelManagementAdvisors]

Gap discovered during claude-agent-platform setup

GITHUB_SCOPES in /opt/github-mcp-auth/.env currently requests:

repo, read:org, read:user, read:project

This blocks the github MCP from creating or updating files under .github/workflows/* in any repo (GitHub returns 404 for write attempts without the workflow scope, even when repo is granted).

Repro

github:create_or_update_file(path=".github/workflows/foo.yml")
# → 404 Not Found

Fix

1. Add workflow to GITHUB_SCOPES in .env
2. Restart github-mcp-auth.service
3. Existing OAuth tokens in DB won't auto-upgrade — users need to disconnect + reconnect the github MCP in their Claude.ai settings to mint a new token with the additional scope.

Why it matters

Without this, any agent flow that involves provisioning GitHub Actions workflows (claude-agent-platform setup, CI bootstrapping, reusable-workflow rollouts) has to fall back to a separate PAT or VPS-side gh CLI auth, which fragments credential management.

References

• GitHub docs on token scopes: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps
• GitHub's workflow scope grants ability to add/update .github/workflows/* files

[NextLevelManagementAdvisors]

@ai-nlma fix this — retriggered via backlog sweep (never-triggered issue, opened but bot was never called; 2026-07-05).

[ai-nlma]

I understand. Working on adding the workflow OAuth scope to the default GITHUB_SCOPES so the MCP can manage .github/workflows/*.yml...

[ai-nlma]

Opened #2 which adds `workflow` to the default `GITHUB_SCOPES` (in `src/github-oauth.ts`, plus `.env.example`/README/CLAUDE.md docs). `npm run build` passes.

Still needed after merge (manual, since the VPS `.env` isn't touched by `npm run deploy`):

1. Add `workflow` to `GITHUB_SCOPES` in `/opt/github-mcp-auth/.env` on the VPS (or unset the var to pick up the new code default).
2. `systemctl restart github-mcp-auth`.
3. Existing users need to disconnect/reconnect the GitHub MCP in Claude.ai settings — old tokens won't auto-upgrade to the new scope.

[ai-nlma]

Done. Summary:

• Root cause: GITHUB_SCOPES defaulted to repo,read:org,read:user,read:project, missing workflow, so GitHub 404s on writes to .github/workflows/*.
• Fix: added workflow to the default scope string in src/github-oauth.ts:17, and updated .env.example, README.md, CLAUDE.md to match.
• Verified npm run build (strict TS) passes.
• Pushed branch fix/add-workflow-oauth-scope, opened PR #2, and commented on issue Add workflow OAuth scope so the MCP can manage .github/workflows/*.yml #1 with the remaining manual VPS steps (.env edit + service restart + user reconnect, since npm run deploy never overwrites the VPS .env).