feat: configure semantic release with GitHub App token for branch protection bypass

- Add GitHub App token generation using tibdex/github-app-token@v2
- Use app token for checkout and semantic release operations
- Enables semantic release to bypass branch protection rules
- App ID: 1870077 configured in repository secrets
- Maintains security while allowing automated releases

Author: Zvi Fried

.github/workflows/semantic-release.yml

@@ -21,11 +21,18 @@ jobs:
       id-token: write
 
     steps:
+    - name: Generate GitHub App Token
+      id: generate_token
+      uses: tibdex/github-app-token@v2
+      with:
+        app_id: ${{ secrets.APP_ID }}
+        private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
     - name: Checkout code
       uses: actions/checkout@v5
       with:
         fetch-depth: 0
-        token: ${{ secrets.GITHUB_TOKEN }}
+        token: ${{ steps.generate_token.outputs.token }}
 
     - name: Install uv
       uses: astral-sh/setup-uv@v6
@@ -49,7 +56,7 @@ jobs:
 
     - name: Run semantic-release
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
         PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
       run: |
         npx semantic-release