We need to think more about how to do this, but it would be interesting to provide the GitHub token of the user using the browser and publish a release or call GitHub API using it.
For example, currently, the wait-for-secrets Action is released using a PAT. PAT is created manually and entered during the workflow. After the workflow is completed, the PAT is deleted.
It would be nice if this process could be made simpler.