For workflows that don't explicitly take a token as an input, you need to configure git to use the generated token. For example, actions/checkout@v4 has a token argument so there is no issue, but your build simply does a pip install or uv sync, then there is no easy mechanism for telling it to use this token. However, this is surely a common pattern. So I propose we add something like this to the README:

      - name: Make git use the app token
        run: | 
            git config --global url."https://USERNAME:${GITHUB_TOKEN}@github.com/".insteadOf "git@github.com:"
            git config --global url."https://USERNAME:${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}