ci(secrets): migrate GITHUB_TOKEN references to PROJECT_TOKEN secret

.github/workflows/docker-build.yml

@@ -83,7 +83,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.PROJECT_TOKEN }}
 
       # Step 5: Figure out what tags to use
       - name: 🏷️ Extract metadata (tags, labels)

.github/workflows/docker-publish.yml

@@ -73,7 +73,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.PROJECT_TOKEN }}
 
       - name: Extract metadata (tags, labels)
         if: steps.skip.outputs.skip_build != 'true'

.github/workflows/propagate-changes.yml

@@ -89,6 +89,6 @@ jobs:
 
             core.info(`Created PR #${pr.data.number}: ${pr.data.html_url}`);
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}
           SOURCE_BRANCH: ${{ steps.branches.outputs.source }}
           TARGET_BRANCH: ${{ steps.branches.outputs.target }}

.github/workflows/release.yml

@@ -44,7 +44,7 @@ jobs:
           draft: false
           prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') || contains(github.ref_name, 'rc') }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}
 
   build-and-publish:
     needs: create-release

.github/workflows/renovate.yml

@@ -22,6 +22,6 @@ jobs:
         uses: renovatebot/github-action@v40.1.11
         with:
           configurationFile: .github/renovate.json
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.PROJECT_TOKEN }}
         env:
           LOG_LEVEL: info