upgrade-main fails when creating Pull Request

The upgrade-main workflow is failing for TypeScript project.

The first Upgrade step succeeds but the second Create Pull Request fails.

My .projenrc.js config is using default behavior:

const { typescript } = require("projen");
const project = new typescript.TypeScriptProject({
  defaultReleaseBranch: "main",
  name: "typesafe-dynamodb",

  deps: [
    "aws-sdk",
    "@aws-sdk/client-dynamodb",
    "@aws-sdk/util-dynamodb",
    "@aws-sdk/smithy-client",
    "@aws-sdk/types",
    "@types/aws-lambda",
  ],
  eslintOptions: {
    ignorePatterns: ["**"],
  },
  tsconfig: {
    compilerOptions: {
      lib: ["dom"],
    },
  },
  gitignore: [".DS_Store"],
  releaseToNpm: true,
});

project.synth();

The stdout of “Setup job”:

Current runner version: '[2](https://github.com/sam-goodwin/typesafe-dynamodb/runs/5255578013?check_suite_focus=true#step:1:2).287.1'
Operating System
Virtual Environment
Virtual Environment Provisioner
GITHUB_TOKEN Permissions
  Contents: write
  Metadata: read
  PullRequests: write
Secret source: Actions
Prepare workflow directory
Prepare all required actions
Getting action download info
Download action repository 'actions/checkout@v2' (SHA:ec3a7ce113134d7a93b817d10a8272cb[6](https://github.com/sam-goodwin/typesafe-dynamodb/runs/5255578013?check_suite_focus=true#step:1:6)[11](https://github.com/sam-goodwin/typesafe-dynamodb/runs/5255578013?check_suite_focus=true#step:1:11)18579)
Download action repository 'actions/download-artifact@v2' (SHA:f023be2c48cc18debc3bacd34cb396e0295e2869)
Download action repository 'peter-evans/create-pull-request@v3' (SHA:f22a7da129c9015[13](https://github.com/sam-goodwin/typesafe-dynamodb/runs/5255578013?check_suite_focus=true#step:1:13)876a2380e2dae9f8e[14](https://github.com/sam-goodwin/typesafe-dynamodb/runs/5255578013?check_suite_focus=true#step:1:14)5330)

stdout of “Checkout”:

Run actions/checkout@v[2](https://github.com/sam-goodwin/typesafe-dynamodb/runs/5255578013?check_suite_focus=true#step:2:2)
  with:
    ref: main
    repository: sam-goodwin/typesafe-dynamodb
    ssh-strict: true
    persist-credentials: true
    clean: true
    fetch-depth: 1
    lfs: false
    submodules: false
Error: Input required and not supplied: token

[sam-goodwin]

To add to the above, the PAT should only need repo, workflows, and packages permission scopes IIRC.

I can confirm creating a PAT with these scopes and storing as PROJEN_GITHUB_TOKEN fixed the problem.

[sam-goodwin]

Thanks guys! Is this documented anywhere? Also, the error message could be more helpful.