tend: bot PAT missing OAuth scopes (workflow, notifications, write:discussion, user)

[prql-bot]

The bot PAT is missing the following classic OAuth scopes required by tend:

• workflow
• notifications
• write:discussion
• user

Granted scopes: gist, read:org, repo.

To remediate, follow step 8 of the install-tend skill: https://github.com/max-sixty/tend/blob/main/plugins/install-tend/skills/install-tend/SKILL.md#8-bot-token-and-secret

Regenerate the PAT with the full required scope set (repo, workflow, notifications, write:discussion, gist, user) and update the TEND_BOT_TOKEN secret.

Last refreshed: 2026-05-23

[prql-bot]

Refreshed audit (2026-05-18): the missing-scope set grew — workflow is now missing in addition to notifications, write:discussion, and user. Granted scopes are now only gist, read:org, repo (previously also included admin:public_key, admin:repo_hook, project, workflow, write:packages). The token appears to have been rotated to a narrower scope set than before. Until workflow is granted, the bot cannot push workflow file changes — this affects the nightly workflow-regeneration step.