docs(config options): PAT triage rights to apply labels forking renovate (#20684)

lib/modules/platform/github/index.md

@@ -20,6 +20,11 @@ You can choose where you want to set `endpoint`:
 - In a environment variable
 - In a CLI parameter
 
+<!-- prettier-ignore -->
+!!! tip "Labels and forking mode"
+    If you're self-hosting Renovate on GitHub.com with GitHub Actions in forking mode, and want Renovate to apply labels then you must give the PAT `triage` level rights on `issues`.
+    The `triage` level allows the PAT to apply/dismiss existing labels.
+
 ## Running as a GitHub App
 
 Instead of a bot account with a Personal Access Token you can run `renovate` as a self-hosted [GitHub App](https://docs.github.com/en/developers/apps/getting-started-with-apps).