update secret names

.github/workflows/automated-release.yml

@@ -60,6 +60,9 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       bump: ${{ steps.bump.outputs.bump }}
+    environment:
+      name: release
+      deployment: false
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -74,7 +77,7 @@ jobs:
       - name: Determine bump type from PR labels
         id: bump
         env:
-          GH_TOKEN: ${{ secrets.PRO_ACCESS_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN_RELEASE }}
         run: |
           set -euo pipefail
 
@@ -127,13 +130,16 @@ jobs:
     needs: [check-changes, determine-bump, ci]
     if: needs.check-changes.outputs.has_changes == 'true'
     runs-on: ubuntu-latest
+    environment:
+      name: release
+      deployment: false
     steps:
       - name: Checkout code # zizmor: ignore[artipacked] the tag push needs it; this job uploads no artifacts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 0
-          token: ${{ secrets.PRO_ACCESS_TOKEN }}
+          token: ${{ secrets.GH_TOKEN_RELEASE }}
 
       - name: Fetch tags
         run: git fetch --tags --force

.github/workflows/ci.yml

@@ -388,6 +388,9 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: write
+    environment:
+      name: release
+      deployment: false
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -457,7 +460,7 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_TOKEN: ${{ secrets.PRO_ACCESS_TOKEN }}
+          HOMEBREW_TAP_TOKEN: ${{ secrets.GH_TOKEN_RELEASE }}
 
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

.github/workflows/create-release-tag.yml

@@ -15,7 +15,7 @@ on:
           - patch
           - minor
 
-# The tag push authenticates with PRO_ACCESS_TOKEN, not GITHUB_TOKEN.
+# The tag push authenticates with GH_TOKEN_RELEASE, not GITHUB_TOKEN.
 permissions:
   contents: read
 
@@ -29,13 +29,16 @@ jobs:
     # Pushes a tag, which triggers the publishing workflows.
     if: github.repository == 'localstack/lstk'
     runs-on: ubuntu-latest
+    environment:
+      name: release
+      deployment: false
     steps:
       - name: Checkout code # zizmor: ignore[artipacked] the tag push needs it; this job uploads no artifacts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.release_ref }}
           fetch-depth: 0
-          token: ${{ secrets.PRO_ACCESS_TOKEN }}
+          token: ${{ secrets.GH_TOKEN_RELEASE }}
 
       - name: Fetch tags
         run: git fetch --tags --force

.github/workflows/weekly-go-upgrade.yml

@@ -5,7 +5,7 @@ on:
     - cron: "0 8 * * 1"
   workflow_dispatch:
 
-# create-pull-request pushes and opens the PR with PRO_ACCESS_TOKEN.
+# create-pull-request pushes and opens the PR with GH_TOKEN_OPEN_NEW_PR.
 permissions: {}
 
 jobs:
@@ -49,4 +49,4 @@ jobs:
             dependencies
             semver: patch
             docs: skip
-          token: ${{ secrets.PRO_ACCESS_TOKEN }}
+          token: ${{ secrets.GH_TOKEN_OPEN_NEW_PR }}