chore(release): use GitHub App token instead of PAT

[saada]

Summary

• Replace RELEASE_TOKEN PAT with dedicated diffuse-semantic-release GitHub App via actions/create-github-app-token
• Branch ruleset already updated: admin bypass removed, only the app can push to main

Test plan

• Merge this PR and verify the release workflow runs successfully on main
• Verify admins can no longer push directly to main
• Remove old RELEASE_TOKEN secret after confirming

Summary by CodeRabbit

• Chores
  • Release workflow now uses a dynamically generated GitHub App installation token instead of a static token, improving security and automation for releases.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b24f4787-be13-4761-8f00-5a9688fe20f2

📥 Commits

Reviewing files that changed from the base of the PR and between 45a0543 and fd3e07a.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

Replaces a static RELEASE_TOKEN secret with a generated GitHub App installation token. Adds a step using actions/create-github-app-token@v2 (driven by SEMANTIC_RELEASE_APP_ID and SEMANTIC_RELEASE_APP_PRIVATE_KEY) and passes steps.app-token.outputs.token to checkout and semantic-release actions.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow Authentication .github/workflows/release.yml	Added Generate App Token step using actions/create-github-app-token@v2 that creates steps.app-token.outputs.token. Replaced uses of secrets.RELEASE_TOKEN with the generated token for actions/checkout, python-semantic-release, and python-semantic-release/publish-action.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    actor Maintainer
    participant Secrets as "Repo Secrets"
    participant TokenAction as "create-github-app-token@v2\n(Generate App Token)"
    participant Workflow as "GitHub Actions Workflow"
    participant Checkout as "actions/checkout"
    participant SemanticRelease as "python-semantic-release / publish-action"
    participant GitHub as "GitHub API (Installation Token)"

    Maintainer->>Secrets: Provide SEMANTIC_RELEASE_APP_ID & PRIVATE_KEY
    Secrets->>TokenAction: supply credentials
    TokenAction->>GitHub: request installation token
    GitHub-->>TokenAction: return installation token (steps.app-token.outputs.token)
    TokenAction-->>Workflow: expose token to subsequent steps
    Workflow->>Checkout: pass token to checkout step
    Workflow->>SemanticRelease: pass token to release/publish steps
    Checkout->>GitHub: perform repo checkout using token
    SemanticRelease->>GitHub: perform release/publish using token

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• ci(release): use fine-grained PAT for branch protection bypass #183 — Also modifies .github/workflows/release.yml to change release-step authentication; that PR switches to a fine-grained PAT while this one switches to a GitHub App installation token.

Poem

🐰 A token sprung from moonlit keys,
Fresh for each release with nimble ease,
No stale secret left to stay,
I hop, I push, I dance—hooray! ✨🔑

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: replacing a static PAT (Personal Access Token) with a dynamically generated GitHub App token in the release workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/release-app-token

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[k-chrispens]

Thanks!!