chore(docs): Update explanation for token input

[ocean90]

The token input is actually not used for pushing the commit. It's only used for fetching author data from the API.
To trigger other workflows the token needs to be added to the actions/checkout step because that auth will be used for the git commands of this action. This PR tries to clarify this a bit more.

// ....

      - uses: actions/checkout@v2
        with:
          token: ${{ secrets.MY_PAT }}

      - uses: EndBug/add-and-commit@v6
        with:
          token: ${{ secrets.MY_PAT }} // This should not be necessary as the default token always has API access.

[EndBug]

Hi, thanks for the PR! Just a quick question: are you sure it's necessary to use it in actions/checkout too? I'm just asking because I've never needed to trigger any other run with the action

[ocean90]

Yes, it took a while to realize that the token for this action isn't really necessary since it isn't used for the git actions. For the workflows it's important who made the commit and if it's from the default GitHub token no other workflows are triggered.

[EndBug]

Oh ok I get it: the token that the simple-git package is using inside the action is the one associated with the local git repository, which is created by the actions/checkout step.

[EndBug]

Sorry, I was just thinking: if it's the repo token (which is set by actions/checkout) to determine whether the action will trigger ci checks or not and if the GitHub token (which we're using only to access the API) has always the repo scope, then couldn't we get rid of the token input altogether?

[ocean90]

I'm not sure if there are environments where the default token doesn't exist/has no repo access. Since it's already optional I don't see any harm in keeping it. We could also update the comment to "and optionally here" as long as we say that it's not the one used for commits.

Oh ok I get it: the token that the simple-git package is using inside the action is the one associated with the local git repository, which is created by the actions/checkout step.

Correct, that's also documented here.

[EndBug]

I've moved the token info to a new paragraph, what do you think?
I'll also add an index to the README so that it's easier to navigate.

[ocean90]

@EndBug Looks good to me!

[EndBug]

@all-contributors please add @ocean90 for docs

[allcontributors]

@EndBug

I've put up a pull request to add @ocean90! 🎉