modify workflow for github app deployment

Author: pthurlow

.github/workflows/publish-homebrew.yml

@@ -11,17 +11,23 @@ jobs:
   publish-homebrew-formula:
     runs-on: ubuntu-22.04
     env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       PLAN: ${{ inputs.plan }}
-      GITHUB_USER: "axo bot"
-      GITHUB_EMAIL: "admin+bot@axo.dev"
     if: ${{ !fromJson(inputs.plan).announcement_is_prerelease || fromJson(inputs.plan).publish_prereleases }}
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.HOTDATA_AUTOMATION_APP_ID }}
+          private-key: ${{ secrets.HOTDATA_AUTOMATION_PRIVATE_KEY }}
+          owner: hotdata-dev
+          repositories: homebrew-tap
+
       - uses: actions/checkout@v6
         with:
           persist-credentials: true
           repository: "hotdata-dev/homebrew-tap"
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Fetch homebrew formulae
         uses: actions/download-artifact@v7
@@ -32,8 +38,8 @@ jobs:
 
       - name: Patch and commit formula files
         run: |
-          git config --global user.name "${GITHUB_USER}"
-          git config --global user.email "${GITHUB_EMAIL}"
+          git config --global user.name "hotdata-automation[bot]"
+          git config --global user.email "hotdata-automation[bot]@users.noreply.github.com"
 
           for release in $(echo "$PLAN" | jq --compact-output '.releases[] | select([.artifacts[] | endswith(".rb")] | any)'); do
             filename=$(echo "$release" | jq '.artifacts[] | select(endswith(".rb"))' --raw-output)
@@ -55,6 +61,8 @@ jobs:
           git push
 
       - name: Remove .rb from GitHub Release assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           TAG=$(echo "$PLAN" | jq -r '.announcement_tag')
           if [ -z "$TAG" ] || [ "$TAG" = "null" ]; then