Do this before Sprint 2, not during it

GitHub Personal Access Token — Setup Checklist

Your pipeline needs a token to read and write your repo automatically. Fine-grained PATs split permissions into separate scopes — get the wrong ones and your Action fails with a permissions error that looks nothing like "you're missing a scope." Set it up right, once, now.

Steps

Go to GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens.

Not the "classic" token type — use fine-grained, so you can scope it tightly to just your team's repo.

Set "Resource owner" and "Repository access" to your team's repo only.

Don't grant access to all repos. One token, one repo.

Set an expiration.

90 days comfortably covers the trimester. Note the date somewhere your team can see it — an expired token mid-sprint looks identical to a broken pipeline.

Grant exactly these permission scopes — no more, no fewer:

Scope	Access level	What it's for
`Contents`	Read and write	Committing pipeline output, reading data files
`Actions`	Read and write	Triggering / re-running workflow runs
`Workflows`	Read and write	Editing files under `.github/workflows/`
`Secrets`	Read and write	Only if your automation manages repo secrets itself — most teams won't need this one

Store it as a repo secret — never in a committed file.

Repo → Settings → Secrets and variables → Actions → New repository secret. Reference it in your workflow as ${{ secrets.YOUR_SECRET_NAME }}.

Test it with one small write before you build anything on top of it.

A simple Action that commits a one-line timestamp file is enough to confirm the token actually has the access you think it has.

Common failure mode: a token with Contents but not Workflows access will let your pipeline commit data fine, but any change to the workflow file itself gets silently rejected. If your Action runs but a workflow-file edit doesn't take effect, this is almost always why.