use HOMEBREW_BUMP_PR_TOKEN to open pr

Signed-off-by: Bugen Zhao <i@bugenzhao.com>

Author: BugenZhao

.github/workflows/bump_risingwave.yml

@@ -16,9 +16,9 @@ jobs:
     runs-on: ubuntu-latest
     env:
       HOMEBREW_NO_INSTALL_FROM_API: 1 # https://github.com/Homebrew/brew/issues/15049
-      HOMEBREW_GITHUB_API_TOKEN: ${{ github.token }}
-      GH_TOKEN: ${{ github.token }}
-      GITHUB_TOKEN: ${{ github.token }}
+      HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_BUMP_PR_TOKEN }}
+      GH_TOKEN: ${{ secrets.HOMEBREW_BUMP_PR_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.HOMEBREW_BUMP_PR_TOKEN }}
       TAP: ${{ github.repository_owner }}/risingwave
     steps:
       - name: Set up Homebrew

README.md

@@ -47,6 +47,7 @@ $ $(brew --prefix risingwave@1.2)/bin/risingwave --version
 ### GitHub Actions
 
 We use the manual GitHub Actions workflow `bump risingwave` to bump the formula. This requires write access to this repository.
+The workflow expects a repository secret `HOMEBREW_BUMP_PR_TOKEN` (PAT or GitHub App token) with permissions to push branches and open PRs.
 
 1. Go to **Actions** → **bump risingwave** → **Run workflow**
 2. (Optional) Set `version` to `x.y.z`. If left empty, it uses the latest stable release (ignores prereleases).