ci: use GitHub App for releases

Author: Lash-L

.github/RELEASE_APP.md

@@ -0,0 +1,23 @@
+# Release GitHub App
+
+Releases use a GitHub App installation token instead of a personal access
+token. The App token is short-lived and lets Python Semantic Release commit the
+version and changelog, push the release tag, and create the GitHub release.
+
+## Organization setup
+
+1. Create a GitHub App owned by the `Python-roborock` organization.
+2. Disable webhooks and grant the App **Contents: Read and write** repository
+   permission. No other optional repository or organization permissions are
+   required.
+3. Install the App only on the `python-roborock` repository.
+4. In the `main` branch protection settings, add the App to **Allow specified
+   actors to bypass required pull requests**. Without this bypass,
+   semantic-release cannot commit the generated release files back to `main`.
+5. Add the App's client ID as the repository variable
+   `RELEASE_APP_CLIENT_ID`.
+6. Generate a private key for the App and save the complete PEM file as the
+   `release` environment secret `RELEASE_APP_PRIVATE_KEY`.
+
+After a successful release using the App, remove the old maintainer-owned
+`GH_TOKEN` repository secret.

.github/workflows/ci.yml

@@ -127,11 +127,20 @@ jobs:
       with:
         fetch-depth: 0
         persist-credentials: false
+    - name: Create release GitHub App token
+      id: release-token
+      uses: actions/create-github-app-token@v3
+      with:
+        client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+        private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+        permission-contents: write
     - name: Python Semantic Release
       id: release
       uses: python-semantic-release/python-semantic-release@v10.5.3
       with:
-        github_token: ${{ secrets.GH_TOKEN }}
+        # The release App is allowed to bypass the pull-request requirement so
+        # semantic-release can commit the version and changelog back to main.
+        github_token: ${{ steps.release-token.outputs.token }}
         changelog: true
 
     - name: Publish package distributions to PyPI
@@ -148,5 +157,5 @@ jobs:
       uses: python-semantic-release/publish-action@v10.5.3
       if: steps.release.outputs.released == 'true'
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        github_token: ${{ steps.release-token.outputs.token }}
         tag: ${{ steps.release.outputs.tag }}