I would add a sentence about the fact that when accessing the repository from which the GitHub Actions event is triggered, it creates a token for us without any additional configuration. This solves most cases of using the our action and saves reading long documentation.

Note: If we want the push to trigger the actions again or something else, you will need to create you own token, since the GitHub's token does not have permission to do anything else other than push.

I'm closing the PR because I think the use of tokens, permissions, and secrets is in general already documented here and in the GitHub upstream documentation. Feel free to reopen it if needed.