Re: https://fossil-scm.org/home/doc/tip/www/mirrortogithub.md

If your GitHub account uses two-factor authentication (2FA), you will have to generate a personal access token and use that in place of your actual password in the URL. This token should have “repo” scope enabled, only.

I had to go through the the Github page workflow a couple times to get this working. For a fine grained access token it wasn't enough to simply choose "Public repos/All repos/Select repos" and generate the token.

I needed to explicitly expand Repository Permissions and tick the box for:

• Contents : Read and Write

(I also added Commit statuses for good measure, perhaps unnecessary.)