[BUG]: Wiki changes can't push currently

[BenHenning]

Describe the bug

Attempts to update the wiki are failing during wiki deployment:

...
Switched to a new branch 'master'
remote: Permission to oppia/oppia-android.wiki.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/oppia/oppia-android.wiki.git/': The requested URL returned error: 403

From https://github.com/oppia/oppia-android/actions/runs/13187896020/job/36818438965#step:3:264.

Steps To Reproduce

Make a change to the wiki and submit the PR, or manually trigger a wiki deployment via the actions workflow.

Expected Behavior

Deployment should succeed.

Screenshots/Videos

No response

What device/emulator are you using?

N/A

Which Android version is your device/emulator running?

N/A

Which version of the Oppia Android app are you using?

N/A

Additional Context

This is very likely tied to a policy update made at the Oppia organization level recently where GITHUB_TOKEN was restricted to only have "read repository contents and packages" permissions. Oppia web and Android have different approaches for deployment which is why we're only seeing this for Android:

• Oppia web has an explicit process for fetching the auth token using a secret: https://github.com/oppia/oppia-web-developer-docs/blob/4b4e27ab12da2f582b87e2ffb7e70cdbb5a4a7b5/.github/workflows/deploy.yml#L15-L18 and https://github.com/oppia/get-github-app-token.
• Oppia Android relies on GITHUB_TOKEN since the workflow isn't running cross-repository:

  oppia-android/.github/workflows/wiki.yml

  Lines 38 to 53 in a4317ba

  	wiki-deploy:
  	runs-on: ${{ matrix.os }}
  	strategy:
  	matrix:
  	os: [ubuntu-20.04]
  	if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
  	steps:
  	- uses: actions/checkout@v3
  	with:
  	fetch-depth: 0
  	- name: Add remote
  	run: |
  	git filter-branch --subdirectory-filter wiki/ -- --all
  	git remote set-url origin https://github.com/oppia/oppia-android.wiki.git
  	git checkout -b master
  	git push origin master --force

https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token describes the permission levels for GITHUB_TOKEN. I suspect all we need to do is update the required permissions for the workflow so that it has the correct permissions per https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token#defining-access-for-the-github_token-permissions.

[BenHenning]

After #5700 was merged, it seems like the wiki deployment did not re-run:

It's not obvious to me at all why it didn't run for the latest develop changes--I'd actually expect it to run every PR that gets merged but it doesn't seem like that's the case.

Edit: Ah, nevermind this does make sense. The triggers filter based on changes to the wiki folder, and that PR didn't. I'll manually re-run the deploy script for the wiki and verify that it updated.

[BenHenning]

Looks like we're going to need support for workflow_dispatch in order to test this. Sent #5703 out for review so that the wiki fix can actually be verified on develop.