docs: explain PAT usage

README.md

@@ -8,7 +8,6 @@ This workflow will be adding the `hacktoberfest` topic to your repo and label al
 
 The workflow will behave differently if executed in October. You can run it once at the beginning of November to remove the `hacktoberfest` topic from your repo and un-label your issues.
 
-
 ```yaml
 name: Hacktoberfest
 
@@ -26,5 +25,10 @@ jobs:
     steps:
       - uses: browniebroke/hacktoberfest-labeler-action@main
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
 ```
+
+Note that the default `secrets.GITHUB_TOKEN` hasn't got [enough permissions][token-permissions], and cannot update the repository's topics. You should create a repo scoped  [personal access token][pat] instead.
+
+[token-permissions]: https://docs.github.com/en/free-pro-team@latest/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token
+[pat]: https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token