From dcb01ec26460e8390f66ec6f1967575179059064 Mon Sep 17 00:00:00 2001
From: Harrison Weinstock <hkobew@amazon.com>
Date: Fri, 22 May 2026 15:14:04 +0000
Subject: [PATCH] ci: use GitHub App token for prerelease workflow

---
 .github/workflows/prerelease-tarball.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/prerelease-tarball.yml b/.github/workflows/prerelease-tarball.yml
index 70be0d6aa..c0d41f9f9 100644
--- a/.github/workflows/prerelease-tarball.yml
+++ b/.github/workflows/prerelease-tarball.yml
@@ -29,9 +29,15 @@ jobs:
         run: |
           TARBALL_NAME=$(ls *.tgz | head -1 | xargs basename)
           echo "name=$TARBALL_NAME" >> $GITHUB_OUTPUT
+      - name: Generate GitHub App Token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - name: Create or update prerelease
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           TARBALL_NAME: ${{ steps.tarball.outputs.name }}
         run: |
           TAG="prerelease"