Use GITHUB_TOKEN for opening automated PRs (#3783)

Problem: NGINX_PAT no longer works for opening PRs

Solution: Use GITHUB_TOKEN with pull request permissions instead

Author: ciarams87

.github/workflows/ci.yml

@@ -38,7 +38,6 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
-          token: ${{ github.actor == 'renovate[bot]' && secrets.NGINX_PAT || github.token }}
 
       - name: Setup Golang Environment
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0

.github/workflows/nfr.yml

@@ -192,7 +192,7 @@ jobs:
       - name: Open a PR with the results
         uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
-          token: ${{ secrets.NGINX_PAT }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: NFR Test Results for NGF version ${{ needs.vars.outputs.version }}
           author: nginx-bot <[email protected]>
           committer: nginx-bot <[email protected]>

.github/workflows/release-pr.yml

@@ -20,6 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     permissions:
       contents: write
+      pull-requests: write
     steps:
       - name: Branch
         id: branch
@@ -83,7 +84,7 @@ jobs:
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
-          token: ${{ secrets.NGINX_PAT }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: Release ${{ inputs.version }}
           title: Release ${{ inputs.version }}
           draft: true

.github/workflows/renovate-build.yml

@@ -49,7 +49,6 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ github.head_ref }}
-          token: ${{ secrets.NGINX_PAT }}
 
       - name: Setup Golang Environment
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0