how to renew token for `SUDO_GITHUB_TOKEN`?

hi @chartgerink, hope you can help us with a brief guide on how to proceed:

From #376

> My main consideration here is that it remains clear who authorized the token and can renew it if it expires.

The token is now expired, and one workflow is failing https://github.com/epiverse-trace/epiverse-trace.github.io/actions/runs/23428529052

Asking Copilot, we have these steps to follow. Some questions are:

- Do you know if the token scopes differ from your/the original configuration?
- Would you edit any of these steps?

Cc'ing @bbah74 @Degoot-AM (discussed in meeting) @joshwlambert (reported the issue)

---

## 🔄 Token Renewal Process: `SUDO_GITHUB_TOKEN`

**Status:** The `SUDO_GITHUB_TOKEN` has expired and needs to be renewed.

**Who should perform this:** Repository owner or organization maintainer with admin access to the epiverse-trace organization.

---

### **Step-by-Step Guide**

#### **Step 1: Generate a New Personal Access Token (PAT)**
1. Go to [GitHub Developer Settings → Personal Access Tokens (Classic)](https://github.com/settings/tokens)
2. Click **"Generate new token (classic)"**
3. **Token name:** `SUDO_GITHUB_TOKEN-renewal-[DATE]` (e.g., `SUDO_GITHUB_TOKEN-renewal-2026-03-25`)
4. **Expiration:** Set to 90 days (or your preferred rotation interval)
5. **Scopes to select:**
- ✅ `repo` (full control of private repositories)
- ✅ `workflow` (update GitHub Action workflows)
6. Click **"Generate token"** and **copy the token immediately** (you won't see it again)

**Reference:** [Creating a personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic)

---

#### **Step 2: Update the Repository Secret**
1. Go to the repository: [epiverse-trace/epiverse-trace.github.io](https://github.com/epiverse-trace/epiverse-trace.github.io)
2. Navigate to **Settings → Secrets and variables → Actions**
3. Find **`SUDO_GITHUB_TOKEN`** in the list
4. Click **"Update"**
5. Paste the new token value you copied in Step 1
6. Click **"Update secret"**

**Reference:** [Managing secrets for GitHub Actions](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions)

---

#### **Step 3: Verify the Token Works**
1. Go to the [Merge Schedule workflow runs](https://github.com/epiverse-trace/epiverse-trace.github.io/actions/workflows/scheduler.yml)
2. Wait for the next scheduled run (daily at 8 AM UTC), or manually trigger a test PR
3. Verify that the workflow completes successfully

---

#### **Step 4: Document the Renewal**
Create a comment or issue noting:
- ✅ Token renewal completed on: **2026-03-25**
- ✅ New expiration date: **[DATE]**
- ✅ Token authorizer: **[Your GitHub handle]**
- ✅ Next renewal reminder: **[DATE]**

---

### **Important Security Notes**
- ⚠️ Only repository/organization admins should perform this renewal
- 🔒 The token is only used by the `scheduler.yml` workflow—verify it's not used elsewhere
- ⏰ Set a calendar reminder for the new expiration date
- 🔄 Consider rotating tokens every 6 months as a security best practice

---