Publish workflow writes to the repository by updating the changelog and creating a release. Instead of using a PAT secret it should use the automatic token generation provided by Github. This is more secure and would prevent the need to manually regenerate PAT secrets each time the old ones expire.