The commitizen action seems to generate files with a different file permission, which prevents the action from staging them. To reproduce, make sure you are cloning the repository with a deploy key.
The only workaround I found is just to run cz bump yourself.