Workflow can't seem to access organisation secret

[Southpaw1496]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Workflow Configuration

Discussion Details

A few years ago, I built a GitHub Actions workflow to build and deploy a website. This has worked well, but when I copied the workflows over to a new site, they don't work and I can't figure out why.

Background

The build and deploy processes are both reusable workflows inside their own jobs:

jobs:
  build-website:
    uses: ./.github/workflows/build-website.yaml

  publish:
    uses: ./.github/workflows/publish-website.yaml
    needs: build-website
    secrets: inherit
    with:
      deploy: ${{ github.ref_name == 'main' }}

The built website is uploaded as an artefact and then downloaded by the publish job:

# publish-website.yaml (abridged)
jobs:
  publish:
    permissions:
      contents: read
    env:
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
      GITHUB_RUN_ID: ${{ inputs.run-id }}
      GITHUB_TOKEN: ${{ secrets.COZY_PAT }}
    steps:
      - name: Download Website HTML
        uses: actions/download-artifact@v8
        with:
          name: html
          run-id: ${{ env.GITHUB_RUN_ID }}
          github-token: ${{ env.GITHUB_TOKEN }}

secrets.COZY_PAT is a Personal Access Token which has Repository and Actions read-and-write permissions for both repositories, though it was only granted permission for the new repository after the secret had been set. It's an organisation secret, so they both should be able to access it. However, in the new repository, the actions/download-artefact step fails with a 401 error. Why would it work in one repository and not the other?