It turns out that by using the fancy third-party "bump the Homebrew PR" action, we were actually making our lives much more difficult. We can use a Penny app installation token and have Homebrew fork the core repo directly into the Vapor org (which is a much more sensible place for it), completely eliminating the dependency on the VaporBot user and saving a goodly amount of time in the bargain.
It turns out that by using the fancy third-party "bump the Homebrew PR" action, we were actually making our lives much more difficult. We can use a Penny app installation token and have Homebrew fork the core repo directly into the Vapor org (which is a much more sensible place for it), completely eliminating the dependency on the VaporBot user and saving a goodly amount of time in the bargain.