ci: use GitHub App for releases

[Lash-L]

What changed

• Generate a short-lived, repository-scoped GitHub App installation token during the release job.
• Use that token for Python Semantic Release's version/changelog commit, tag, and GitHub release publishing.
• Document the GitHub App installation, least-privilege permission, protected-branch bypass, variable, and secret setup.

Why

The release workflow currently depends on GH_TOKEN, a personal access token owned by a maintainer. The built-in GITHUB_TOKEN cannot commit the generated release changes directly to main because the branch requires an approved pull request.

The organization-owned python-roborock-release-bot App has only Contents: write, is installed only on this repository, and is explicitly allowed to bypass the pull-request requirement for release write-backs. Its installation token is short-lived and is revoked after the job.

PyPI trusted publishing remains unchanged.

Configuration

The repository has been configured with:

• RELEASE_APP_CLIENT_ID repository variable
• RELEASE_APP_PRIVATE_KEY secret in the release environment
• python-roborock-release-bot as an allowed bypass actor on the main branch protection rule

Keep the existing GH_TOKEN until the first App-powered release succeeds.

Validation

• check-yaml
• trailing-whitespace
• end-of-file-fixer
• codespell
• detect-private-key
• commitlint
• verified App registration has Contents: write
• verified App is present in main's pull-request bypass list

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.