chore(release): use GitHub App token for releases

[kruton]

No description provided.

[Copilot]

Pull request overview

Updates the release automation GitHub Actions to mint and use a GitHub App token for release-related pushes/PR operations, and adds an explicit maintainer-authorization gate before generating the App token.

Changes:

• Add an “Authorize release actor” step to release workflows to ensure only maintainers/admins can trigger release automation before secrets are used.
• Generate a GitHub App token and route PUSH_TOKEN / GH_TOKEN to that token for release branch creation and release PR updates.
• Delay configure_git_credentials calls in release scripts to closer to the git push operations.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/release-publish.yml	Adds maintainer authorization step prior to creating the release App token.
.github/workflows/release-prepare.yml	Switches pushing/PR updates to a GitHub App token; adds maintainer authorization step.
.github/workflows/release-branch.yml	Switches branch push to a GitHub App token; adds maintainer authorization step.
.github/scripts/publish-release.sh	Defers git credential setup until right before the push.
.github/scripts/prepare-release.sh	Defers git credential setup until right before the push.
.github/scripts/create-release-branch.sh	Defers git credential setup until right before the push.

Comments suppressed due to low confidence (1)

.github/scripts/publish-release.sh:68

• configure_git_credentials is now invoked only right before git push, but this script performs multiple remote operations (git fetch, git rev-list, git show origin/...) before credentials are configured. Since the workflow uses actions/checkout with persist-credentials: false, these remote operations will run unauthenticated and will fail on private repositories (and can be less reliable under stricter org policies). Consider configuring credentials (or otherwise providing auth, e.g., via an extraheader) before the first network git operation that needs access to origin while still keeping the push token exposure minimal.

configure_git_author
git fetch origin \
  "+refs/heads/${target_branch}:refs/remotes/origin/${target_branch}" \
  "+refs/heads/${work_branch}:refs/remotes/origin/${work_branch}" \
  --tags

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.