Use GitHub App token in Build-Module workflow

Mint an installation token in Build-Module.yml (same pinned
actions/create-github-app-token@fee1f7d... as Plan and Publish-Module)
and inject it as GH_TOKEN on the Build-PSModule step.

This covers the three gh repo view calls in Build-PSModuleManifest.ps1
that read repo description, topics, and URL — all of which go through
the gh CLI and therefore consume GH_TOKEN.

The job-level GH_TOKEN: github.token fallback is removed.
workflow.yml is updated to pass the GitHubAppClientId and
GitHubAppPrivateKey secrets into the Build-Module reusable workflow.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

.github/workflows/Build-Module.yml

@@ -2,6 +2,13 @@ name: Build-Module
 
 on:
   workflow_call:
+    secrets:
+      GitHubAppClientId:
+        description: The client ID of the GitHub App used for repository API calls.
+        required: true
+      GitHubAppPrivateKey:
+        description: The private key of the GitHub App used for repository API calls.
+        required: true
     inputs:
       Settings:
         type: string
@@ -20,8 +27,6 @@ jobs:
   Build-Module:
     name: Build-Module
     runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ github.token }}
     steps:
       - name: Checkout Code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -37,8 +42,17 @@ jobs:
           path: _wf
           persist-credentials: false
 
+      - name: Create GitHub App token
+        id: App-Token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        with:
+          app-id: ${{ secrets.GitHubAppClientId }}
+          private-key: ${{ secrets.GitHubAppPrivateKey }}
+
       - name: Build module
         uses: ./_wf/.github/actions/Build-PSModule
+        env:
+          GH_TOKEN: ${{ steps.App-Token.outputs.token }}
         with:
           Name: ${{ fromJson(inputs.Settings).Name }}
           Version: ${{ fromJson(inputs.Settings).Publish.Module.Resolution.Version != '' && fromJson(inputs.Settings).Publish.Module.Resolution.Version || '999.0.0' }}

.github/workflows/workflow.yml

@@ -116,6 +116,9 @@ jobs:
   Build-Module:
     if: fromJson(needs.Plan.outputs.Settings).Build.Module.Enabled
     uses: ./.github/workflows/Build-Module.yml
+    secrets:
+      GitHubAppClientId: ${{ secrets.GitHubAppClientId }}
+      GitHubAppPrivateKey: ${{ secrets.GitHubAppPrivateKey }}
     needs:
       - Plan
     with: