ci(release): open the Homebrew formula PR with a GitHub App token

.github/workflows/release.yml

@@ -280,16 +280,19 @@ jobs:
     needs: [publish, formula]
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    permissions:
-      actions: write
-      contents: write
-      issues: write
-      pull-requests: write
     steps:
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
       - name: Checkout
         uses: actions/checkout@v7
         with:
           ref: main
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Download formula
         uses: actions/download-artifact@v8
@@ -299,7 +302,7 @@ jobs:
 
       - name: Open formula PR
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           # Follow the latest release, or the newest prerelease before the first stable one.
           latest=$(
@@ -342,8 +345,8 @@ jobs:
           fi
 
           git \
-            -c user.name='github-actions[bot]' \
-            -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
+            -c user.name='hakula-release-bot[bot]' \
+            -c user.email='351352052+hakula-release-bot[bot]@users.noreply.github.com' \
             commit -am "$title"
           # A rerun rebuilds this commit on the current main and replaces the earlier push.
           git push --force origin "$branch"
@@ -357,19 +360,9 @@ jobs:
               --label chore \
               --body-file .github/templates/homebrew-formula-pr.md
           then
-            echo "::error::Could not open the formula PR." \
-              'Enable "Allow GitHub Actions to create and approve pull requests"' \
-              'in Settings > Actions > General, then rerun this job.'
-            exit 1
-          fi
-
-          # GitHub holds CI on a PR opened with GITHUB_TOKEN until approved, so dispatch CI now.
-          run_url=$(gh workflow run ci.yml --ref "$branch")
-          if [[ -z "$run_url" ]]; then
-            echo "::error::The CI dispatch on $branch returned no run."
+            echo "::error::Could not open the formula PR."
             exit 1
           fi
-          echo "Dispatched CI: $run_url"
 
   notes:
     name: Republish Release Notes

RELEASING.md

@@ -133,7 +133,7 @@ Watch the [Release workflow](https://github.com/hakula139/oxide-code/actions/wor
 - Every [target](#targets) archive and its `.sha256` sidecar are attached, and `gh attestation verify <archive> --repo hakula139/oxide-code` passes for one of them.
 - `nix run github:hakula139/oxide-code/vX.Y.Z -- --version` prints the version on one host.
 
-The workflow then renders the formula from the release sidecars, installs it through a local tap on `macos-latest` and `ubuntu-latest`, and runs `brew test` there before it opens a `chore(release): refresh Homebrew formula for vX.Y.Z` PR. The same check runs on pull requests that touch the formula, its rendering script, or the release workflows. Merging that PR is the final release step. Because GitHub Actions opened it with `GITHUB_TOKEN`, GitHub holds the PR's runs until someone with write access approves them in the Actions tab ([#364](https://github.com/hakula139/oxide-code/issues/364)). Approve them, wait for the PR's checks to pass, then squash-merge it. The formula follows the latest release, or the newest prerelease until the first stable release, so other tags skip this job. If the job fails, fix the cause and rerun it, since a rerun rebuilds the branch and reuses an open PR.
+The workflow then renders the formula from the release sidecars, installs it through a local tap on `macos-latest` and `ubuntu-latest`, and runs `brew test` there before it opens a `chore(release): refresh Homebrew formula for vX.Y.Z` PR. The same check runs on pull requests that touch the formula, its rendering script, or the release workflows. Merging that PR once its checks pass is the final release step. The formula follows the latest release, or the newest prerelease until the first stable release, so other tags skip this job. If the job fails, fix the cause and rerun it, since a rerun rebuilds the branch and reuses an open PR.
 
 ## Re-Cut an Existing Tag