fix(ci): use permissions instead of PAT for checkout/push

Author: namastex888

.github/workflows/auto-version-bump.yml

@@ -23,6 +23,9 @@ concurrency:
   group: auto-version-bump-${{ github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: write
+
 jobs:
   version-bump:
     # Run on: workflow_dispatch OR (merged PR with rc/stable label, not from bot)
@@ -37,7 +40,6 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.PAT_TOKEN }}
 
       - name: Determine bump type
         id: check
@@ -100,7 +102,7 @@ jobs:
           fi
 
       - name: Trigger forge-core pre-release
-        if: steps.bump.outputs.new_version != ''
+        if: steps.bump.outputs.new_version != '' && secrets.PAT_TOKEN != ''
         uses: peter-evans/repository-dispatch@v2
         with:
           token: ${{ secrets.PAT_TOKEN }}