[FR] Switch to ephemeral tokens for non DR workflows

[eric-forte-elastic]

Pull Request

Issue link(s):

Related to #6464, https://github.com/elastic/ia-trade-team/issues/960

Summary - What I changed

Re-adds ephemeral GitHub token support (via elastic/ci-gh-actions/fetch-github-token) for the workflows where the previous rollout showed no blockers. This partially reverses #6464, which reverted ephemeral tokens across all workflows after issues that were specific to WRITE_TRADEBOT_DETECTION_RULES_TOKEN.

How To Test

• Ephemeral use of the integrations token successfully created integrations PR [Security Rules] Update security rules package to v9.5.1-beta.1 integrations#20093.

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[github-actions]

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a feature to the code.

Documentation and Context

• Describe the feature enhancement in detail (alternative solutions, description of the solution, etc.) if not already documented in an issue.
• Include additional context or screenshots.
• Ensure the enhancement includes necessary updates to the documentation and versioning.

Code Standards and Practices

• Code follows established design patterns within the repo and avoids duplication.
• Ensure that the code is modular and reusable where applicable.

Testing

• New unit tests have been added to cover the enhancement.
• Existing unit tests have been updated to reflect the changes.
• Provide evidence of testing and validating the enhancement (e.g., test logs, screenshots).
• Validate that any rules affected by the enhancement are correctly updated.
• Ensure that performance is not negatively impacted by the changes.
• Verify that any release artifacts are properly generated and tested.
• Conducted system testing, including fleet, import, and create APIs (e.g., run make test-cli, make test-remote-cli, make test-hunting-cli)

Additional Checks

• Verify that the enhancement works across all relevant environments (e.g., different OS versions).
• Confirm that the proper version label is applied to the PR patch, minor, major.

[Copilot]

Pull request overview

This PR reintroduces ephemeral GitHub token usage (via elastic/ci-gh-actions/fetch-github-token) in selected GitHub Actions workflows, replacing long-lived repository secrets for cross-repo checkouts, workflow dispatches, and PR creation.

Changes:

• Adds permissions: id-token: write and fetches ephemeral GitHub tokens via OIDC/Vault in multiple workflows.
• Switches cross-repo operations (checkout, API calls, PR creation) from stored secrets to the fetched ephemeral token.
• Skips OIDC/token-dependent jobs on fork-based pull requests where OIDC ID tokens are not issued.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release-fleet.yml	Uses ephemeral tokens for integrations checkout and PR creation (adds id-token: write).
.github/workflows/release-docs.yml	Uses ephemeral tokens for elastic/security-docs checkout and PR creation (adds id-token: write).
.github/workflows/react-tests-dispatcher.yml	Uses ephemeral token for dispatching REACT workflow; skips fork PRs (adds id-token: write).
.github/workflows/kibana-mitre-update.yml	Uses ephemeral token to comment on a Kibana issue; skips fork PRs (adds id-token: write).

[w0rk3r]

Approving to unblock