Fix all release workflows

[rezrah]

Classic NPM tokens no longer work, so our release workflows are failing.

Fixes it by switching to a combo of:

1. OIDC auhorized tokens for anything that doesn't need workflow follow-ups
2. App tokens for anything that does

[rezrah]

Deploy checks failing, but are non-blocking. Going to test in main branch next. cc. @danielguillan

[Copilot]

Pull request overview

This PR updates the release workflow to address NPM token authentication failures by transitioning from classic NPM tokens to a dual authentication approach: OIDC-authorized tokens for operations that don't trigger follow-up workflows, and GitHub App tokens for those that do.

Key Changes:

• Migrated release-main and release-canary jobs from reusable workflows to inline job definitions with GitHub App token authentication
• Added workflow trigger filters to ignore merge queue branches and tags
• Updated permissions to include write access for contents and pull-requests

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The GitHub App token creation step is missing a descriptive name attribute. While this is not a functional issue, it would improve workflow readability and debugging to add a name like "Generate GitHub App token" or "Create app token", consistent with other named steps in the workflow.

[Copilot]

The GitHub App token creation step is missing a descriptive name attribute. While this is not a functional issue, it would improve workflow readability and debugging to add a name like "Generate GitHub App token" or "Create app token", consistent with other named steps in the workflow.

[Copilot]

The condition for the canary job will now allow it to run on the main branch, causing both release-main and release-canary jobs to run simultaneously on main. The original condition included github.ref_name != 'main' to prevent this overlap. Consider restoring this check or adjusting the logic to ensure only one release job runs per branch.

Suggested change

	if: github.repository == 'primer/doctocat-nextjs' && github.ref_name != 'changeset-release/main'
	if: github.repository == 'primer/doctocat-nextjs' && github.ref_name != 'changeset-release/main' && github.ref_name != 'main'

[Copilot]

The release-candidate job lacks NPM authentication configuration. While it uses the OIDC token (GITHUB_TOKEN) for GitHub operations, the changesets publish command needs to authenticate with npm to publish packages. The release-main and release-canary jobs have explicit authentication setup (app tokens), but this job is missing the necessary npm authentication mechanism. This will cause the publish step to fail.

See below for a potential fix:

      - name: Authenticate with NPM
        uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org/'
          cache: 'npm'
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish release candidate
        run: |
          npm exec --workspaces -- ../../packages/repo-configs/scripts/prepare-release-candidate
          # We use OIDC token here because we don't need Bot to trigger additional workflows
          npx changeset publish --tag next
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}