Replace user PAT with GitHub App for Go publishing

[so0k]

Description

The release_golang job currently uses a personal access token (TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN) to push commits and tags to open-constructs/cdk-terrain-go. This PAT belongs to a user account and can expire, as happened recently (#54).

The cdktn-io org already has a GitHub App (team-cdk-terrain, ID 254218809) that is used for automated commits across all cdktn-io repos. Migrating to this app would:

• Eliminate PAT expiration issues
• Provide consistent bot identity (team-cdk-terrain[bot])
• Align with the pattern used in cdktn-io/cdktn-repository-manager

Prerequisites

• Install the team-cdk-terrain GitHub App on the open-constructs org (requires org admin)
• Grant the app push access to open-constructs/cdk-terrain-go
• Add GH_APP_ID and GH_APP_PRIVATE_KEY secrets to open-constructs/cdk-terrain

Implementation

Replace the PAT-based auth in the release_golang job with:

- name: Generate GitHub App Token
  id: app-token
  uses: actions/create-github-app-token@v2
  with:
    app-id: ${{ secrets.GH_APP_ID }}
    private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
    owner: open-constructs

- name: Release
  run: npx -p publib publib-golang
  env:
    GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
    GIT_USER_NAME: "team-cdk-terrain[bot]"
    GIT_USER_EMAIL: "254218809+team-cdk-terrain[bot]@users.noreply.github.com"

References

• Go releases are failing #54 (Go releases failing due to expired PAT)
• fix(ci): update Go repo git identity from old HashiCorp user #36 (Git identity update)