From 55b776183d5fe47eb7dffc7dbe1f3710089f6b50 Mon Sep 17 00:00:00 2001
From: Finn Evers <finn@zed.dev>
Date: Thu, 9 Jul 2026 13:34:57 +0200
Subject: [PATCH] ci: Fix push permissions for cherry-pick workflow (#60673)

Release Notes:

- N/A
---
 .github/workflows/cherry_pick.yml                | 9 +++++----
 tooling/xtask/src/tasks/workflows/cherry_pick.rs | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/cherry_pick.yml b/.github/workflows/cherry_pick.yml
index 0e18eb2d16d..48474ac0bd5 100644
--- a/.github/workflows/cherry_pick.yml
+++ b/.github/workflows/cherry_pick.yml
@@ -27,10 +27,6 @@ jobs:
   run_cherry_pick:
     runs-on: namespace-profile-2x4-ubuntu-2404
     steps:
-    - name: steps::checkout_repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
-      with:
-        clean: false
     - id: generate-token
       name: steps::authenticate_as_zippy
       uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
@@ -40,6 +36,11 @@ jobs:
         permission-contents: write
         permission-workflows: write
         permission-pull-requests: write
+    - name: steps::checkout_repo
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      with:
+        clean: false
+        token: ${{ steps.generate-token.outputs.token }}
     - name: cherry_pick::run_cherry_pick::cherry_pick
       run: ./script/cherry-pick "$BRANCH" "$COMMIT" "$CHANNEL"
       env:
diff --git a/tooling/xtask/src/tasks/workflows/cherry_pick.rs b/tooling/xtask/src/tasks/workflows/cherry_pick.rs
index cc9e8ca64b4..8621829e095 100644
--- a/tooling/xtask/src/tasks/workflows/cherry_pick.rs
+++ b/tooling/xtask/src/tasks/workflows/cherry_pick.rs
@@ -59,8 +59,8 @@ fn run_cherry_pick(
     named::job(
         Job::default()
             .runs_on(runners::LINUX_SMALL)
-            .add_step(steps::checkout_repo())
             .add_step(authenticate)
+            .add_step(steps::checkout_repo().with_token(&token))
             .add_step(cherry_pick(branch, commit, channel, &token)),
     )
 }