feat(release): authenticate release-please via GitHub App

.github/workflows/release.yaml

@@ -8,7 +8,11 @@ name: Release
 on:
   workflow_call:
     secrets:
-      TAYLORBOT_GITHUB_ACTION:
+      RELEASE_PLEASE_CLIENT_ID:
+        description: Client ID for create-github-app-token
+        required: true
+      RELEASE_PLEASE_PRIVATE_KEY:
+        description: Private key for create-github-app-token
         required: true
     outputs:
       release_created:
@@ -47,10 +51,17 @@ jobs:
       patch: ${{ steps.release_please.outputs.patch }}
       pr: ${{ steps.release_please.outputs.pr }}
     steps:
+      - name: Generate GitHub App token
+        id: generate_token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.RELEASE_PLEASE_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}
+
       - name: Run release-please
         id: release_please
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
-          token: ${{ secrets.TAYLORBOT_GITHUB_ACTION }}
+          token: ${{ steps.generate_token.outputs.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json

CHANGELOG.md

@@ -10,6 +10,7 @@ Instead this file uses a date-based structure.
 
 ### Changed
 
+- `release.yaml` (release-please reusable workflow) now authenticates via a GitHub App instead of a PAT. Callers must pass `RELEASE_PLEASE_CLIENT_ID` and `RELEASE_PLEASE_PRIVATE_KEY` secrets in place of `TAYLORBOT_GITHUB_ACTION`. Using an App token (minted by `actions/create-github-app-token`) means release PRs trigger downstream workflows — unlike commits made with `GITHUB_TOKEN` or PRs opened by a PAT in some configurations — and removes the dependency on the taylorbot user account.
 - `create-release-pr` now opens release PRs with a Conventional Commits-compatible title of the form `chore(release): vX.Y.Z` (previously `Release vX.Y.Z`). The release commit message it creates uses the same form.
 - `create-release` and `update-action-version` accept both the new `chore(release): vX.Y.Z` form and the legacy `Release vX.Y.Z` form, so in-flight release PRs created by older versions of `create-release-pr` continue to be picked up after their merge commit lands.
 - `validate-changelog.yaml` now validates the H3 sections of the version block against the [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) set: `### Added`, `### Changed`, `### Deprecated`, `### Removed`, `### Fixed`, `### Security`. Unknown H3 sections fail validation. `### Security` is accepted for CVE fixes and vulnerability mitigations. Release CHANGELOGs that do not use `### Security` continue to pass.