Fix action token

Author: wu-clan

README.md

@@ -25,6 +25,8 @@ jobs:
         uses: fastapi-practices/plugin-release@v1
         with:
           push-to: your-username/plugins
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
 ```
 
 ## Inputs
@@ -34,6 +36,12 @@ jobs:
 | `push-to`     | Yes      | —                             | The repository to push the update branch to (`owner/repo`), e.g. `your-username/plugins` |
 | `plugin-name` | No       | Repository name of the caller | Plugin name, must match the submodule directory name in `fastapi-practices/plugins`      |
 
+## Environment variables
+
+| Variable   | Required | Description                                                                                                                        |
+| ---------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| `GH_TOKEN` | Yes      | GitHub personal access token with write access to the push-to repository, see [creating a PAT](https://github.com/settings/tokens) |
+
 ## How it works
 
 1. Validates that the version in `plugin.toml` matches the pushed tag

action.yml

@@ -52,7 +52,7 @@ runs:
       uses: actions/checkout@v4
       with:
         repository: ${{ inputs.push-to }}
-        token: ${{ github.token }}
+        token: ${{ env.GH_TOKEN }}
         submodules: true
         fetch-depth: 0
 
@@ -164,5 +164,3 @@ runs:
         PR_NUMBER=$(echo "${PR_URL}" | grep -oE '[0-9]+$')
         echo "pr-number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
         echo "::notice::Pull request created: ${PR_URL}"
-      env:
-        GH_TOKEN: ${{ github.token }}