Cherry-pick workflow sometimes fails due Personal Access Token (PAT) without correct `workflow` scope

[desrosj]

Description

While trying to backport the changes from #76435, the workflow run triggered when adding a "Backport X.Y" label encountered an error:

Target branch: wp/7.0
Commit SHA: 684ad23205876b8c527471a243f3183257027b25
Switched to a new branch 'wp/7.0'
branch 'wp/7.0' set up to track 'origin/wp/7.0'.
Auto-merging .github/workflows/build-plugin-zip.yml
[wp/7.0 3186f5c7b9] CI: Simplify strategy matrix in Build Gutenberg Plugin Zip workflow (#76435)
 Author: Bernie Reiter <96308+ockham@users.noreply.github.com>
 Date: Fri Mar 13 01:51:39 2026 +0100
 1 file changed, 5 insertions(+), 10 deletions(-)
To https://github.com/WordPress/gutenberg
 ! [remote rejected]       wp/7.0 -> wp/7.0 (refusing to allow a Personal Access Token to create or update workflow `.github/workflows/build-plugin-zip.yml` without `workflow` scope)
error: failed to push some refs to 'https://github.com/WordPress/gutenberg'
Error: Process completed with exit code 1.

To rule out any strange conflicts, I performed a cherry-pick on the changes from #76398 first. After that succeeded, I re-triggered the cherry-pick for the original PR and encountered the same issue.

Step-by-step reproduction instructions

The steps to reproduce this are unclear at this time.

Screenshots, screen recording, code snippet

No response

Environment info

No response

Please confirm that you have searched existing issues in the repo.

• Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

• Yes

Please confirm which theme type you used for testing.

• Block
• Classic
• Hybrid (e.g. classic with theme.json)
• Not sure