Use a GitHub App for cutting a new release.

Author: devopsix

.github/workflows/release.yml

@@ -16,8 +16,16 @@ jobs:
     name: Create release
     runs-on: ubuntu-latest
     steps:
+      - name: Create access token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
       - name: Check out from SCM
         uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
       - name: Import GPG key
         uses: crazy-max/ghaction-import-gpg@v6
         with:
@@ -60,7 +68,7 @@ jobs:
           "-DdevelopmentVersion=${{ github.event.inputs.developmentVersion }}"
           "-Dtag=v${{ github.event.inputs.releaseVersion }}"
           "-Dusername=${{ github.actor }}"
-          "-Dpassword=${{ secrets.GITHUB_TOKEN }}"
+          "-Dpassword=${{ steps.app-token.outputs.token }}"
           "-DrepoBaseUrl=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
           release:prepare
       - name: Perform release
@@ -75,7 +83,7 @@ jobs:
           "-DreleaseProfiles=release,-examples"
           "-Darguments=-Dgpg.useagent=false -DrepoBaseUrl=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
           "-Dusername=${{ github.actor }}"
-          "-Dpassword=${{ secrets.GITHUB_TOKEN }}"
+          "-Dpassword=${{ steps.app-token.outputs.token }}"
           "-DrepoBaseUrl=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
           release:perform
       - name: Create GitHub release