Merge pull request #3418 from grafana/vldmr/fix-gh-workflow-update-helm

update-helm-repo: fix oci image push failure

.github/workflows/update-helm-repo.yaml

@@ -94,8 +94,7 @@ jobs:
     needs: [setup]
     runs-on: ubuntu-latest
     permissions:
-      contents: write # to push chart release, create release, and push tags to github
-      packages: write # to push package to ghcr
+      packages: write # allows GITHUB_TOKEN to push package to ghcr
     env:
       github_app_id: ${{ secrets.github_app_id }}
     if: needs.setup.outputs.changed == 'true'
@@ -234,7 +233,9 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ env.AUTHTOKEN }}
+          # GitHub App installation token cannot push package to the org's package registry;
+          # using GITHUB_TOKEN here instead to avoid using PAT.
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push charts to GHCR
         run: |