Document how to clone with a PAT as a read-only action

I’m struggling to understand how I could simply clone repositories in an action, without using deploy keys because they have to be added in each repository to work. PAT permissions are really not user-friendly, and I’d just like to have a simple read:repository permission to have the right to clone a repository’s code. I’m hitting the bug for cloning with a token defined: remote: Write access to repository not granted. but I don’t care about write access to that repository, with my PAT. Is this something possible with a PAT that can only clone and not push ?

[twistedpair]

+1 on @NorseGaud 's situation.

I cannot get a checkout of a private repo as a submodule using FG PATs. Works fine with classic PATs and “Repo” permission.

I wonder if this could have to do with the additional Organization settings recently added to allow/block/require approval for FG PATs in organizations? I set FG PATs to be allowed in my org, but I still get these "remote: Write access to repository not granted. " errors when trying to do read operations with this action.

[twistedpair]

@mifi , is that content: read and metadata: read?

I’m seeing the same problem with fine grained PATs and @actions/checkout@v3

When I use a FG PAT with content: read and metadata: read, and give the PAT’s user read access to the given repo, I still see the remote: Write access to repository not granted. error in GitHub Actions.

Why do we need write access to do a read operation?