fix(ci): use GitHub App token for releases with bypass permissions (#340)

Add support for GitHub App authentication to bypass organization-level
tag creation rulesets. The workflow now:

1. Generates a GitHub App installation token using app credentials
2. Falls back to RELEASE_TOKEN (PAT) if app not configured
3. Falls back to GITHUB_TOKEN for backward compatibility

Priority: GitHub App > PAT > GITHUB_TOKEN

Setup:
- RELEASE_APP_ID: GitHub App ID (2514085)
- RELEASE_APP_PRIVATE_KEY: App private key (PEM format)
- App must be configured as bypass actor in org rulesets

This enables automated releases without manual tag creation.

Author: julienld

.github/workflows/semver-release.yml

@@ -68,26 +68,36 @@ jobs:
       issues: write        # Required for GitHub releases
 
     steps:
+    # Generate GitHub App token with bypass permissions for tag creation
+    - name: Generate GitHub App token
+      id: app-token
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ secrets.RELEASE_APP_ID }}
+        private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+      # Fallback to RELEASE_TOKEN (PAT) or GITHUB_TOKEN if app credentials not configured
+      continue-on-error: true
+
     - uses: actions/checkout@v6
       with:
         fetch-depth: 0
-        # Use RELEASE_TOKEN (PAT/App token with bypass permissions) if available, fallback to GITHUB_TOKEN
-        token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+        # Priority: GitHub App token > RELEASE_TOKEN (PAT) > GITHUB_TOKEN
+        token: ${{ steps.app-token.outputs.token || secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
 
     - name: Python Semantic Release
       id: semantic
       uses: python-semantic-release/python-semantic-release@v10.5.2
       with:
-        # Use RELEASE_TOKEN to bypass tag creation restrictions
-        github_token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+        # Use GitHub App token with bypass permissions
+        github_token: ${{ steps.app-token.outputs.token || secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
         verbosity: "2"
         # Don't create GitHub release here - we'll create a draft below
         vcs_release: "false"
 
     - name: Create draft GitHub release
       if: steps.semantic.outputs.released == 'true'
       env:
-        GH_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+        GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
       run: |
         VERSION="${{ steps.semantic.outputs.version }}"
         TAG="v${VERSION}"