ci(release): use GitHub App token in release-prepare for PR creation (#1317)

* ci(release): use GitHub App token in release-prepare for PR creation

GITHUB_TOKEN is not permitted to create PRs in this repo. Switch to the
GitHub App token (same pattern as release-tag and release-publish) so
melos-action can successfully open the release PR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* ci(release): switch to grdsdev/melos-action fork with token support

Use grdsdev/melos-action@feat/custom-token-for-create-pr across all three
release workflows. Pass the App token to the melos-action in release-prepare
so peter-evans/create-pull-request uses it directly — the fork's token input
is the correct fix for the GITHUB_TOKEN PR creation restriction.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* ci(release): pin melos-action to upstream v3.6.0 SHA

The fork's token input was merged upstream as v3.6.0. Switch all three
release workflows back to bluefireteam/melos-action, pinned to the
release SHA for supply-chain safety.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: grdsdev

.github/workflows/release-prepare.yml

@@ -23,21 +23,29 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+
       - name: Checkout
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
         with:
           cache: true
 
       - name: Setup Melos
-        uses: bluefireteam/melos-action@v3
+        uses: bluefireteam/melos-action@705015c3d2bc4ab94201ac24accb2bbe070cf533 # v3.6.0
         with:
           run-versioning: ${{ inputs.prerelease == false }}
           run-versioning-prerelease: ${{ inputs.prerelease == true }}
           run-versioning-graduate: ${{ inputs.graduate == true }}
           create-pr: true
+          token: ${{ steps.app-token.outputs.token }}

.github/workflows/release-publish.yml

@@ -44,7 +44,7 @@ jobs:
           cache: true
 
       - name: Bootstrap with Melos
-        uses: bluefireteam/melos-action@v3
+        uses: bluefireteam/melos-action@705015c3d2bc4ab94201ac24accb2bbe070cf533 # v3.6.0
 
       - name: Publish dry run
         run: melos publish --scope ${{ inputs.package-name }} --dry-run

.github/workflows/release-tag.yml

@@ -36,7 +36,7 @@ jobs:
           cache: true
 
       - name: Setup Melos
-        uses: bluefireteam/melos-action@v3
+        uses: bluefireteam/melos-action@705015c3d2bc4ab94201ac24accb2bbe070cf533 # v3.6.0
         with:
           tag: true
       - name: Trigger publish workflows