Use GitHub App token for release uploads

[juliusmarminge]

Summary

• Mint a GitHub App token at the start of the release job.
• Use that token for Electron release asset uploads instead of the default workflow token.
• Keep upload permissions scoped to the release app credentials configured in repository secrets.

Testing

• Not run (workflow-only change).
• Verified the release workflow YAML updates the upload steps to pass steps.app_token.outputs.token.
• Verified the token is minted before checkout and available to both release upload steps.

---

Note

Medium Risk
Medium risk because it changes the credentials used by the release workflow; misconfigured app secrets/permissions could cause release creation or asset uploads to fail.

Overview
The release workflow now mints a GitHub App installation token (actions/create-github-app-token@v2) at the start of the release job.

Both softprops/action-gh-release@v2 steps (existing release and first release) are updated to use that App token via token: ${{ steps.app_token.outputs.token }}, instead of relying on the default workflow token.

^{Reviewed by Cursor Bugbot for commit 8f158bd. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Use GitHub App token for release uploads in the release workflow

The Publish GitHub Release job in release.yml now mints a GitHub App token via actions/create-github-app-token@v2 and passes it explicitly to both release publishing steps, replacing the default workflow token.

^{Macroscope summarized 8f158bd.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 8a42adb6-251f-4582-8132-0bcfb850c0cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/release-app-token

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}