Use GitHub App token when creating the release instead.

Author: dlemstra

.github/workflows/release.yml

@@ -46,13 +46,22 @@ jobs:
     needs: build
 
     permissions:
-      contents: write
-      id-token: write
       attestations: write
+      id-token: write
 
     steps:
+      - name: Create GitHub app token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 #v3.2.0
+        id: app-token
+        with:
+          client-id: ${{vars.APP_CLIENT_ID}}
+          private-key: ${{secrets.APP_PRIVATE_KEY}}
+          permission-contents: write
+
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          token: ${{steps.app-token.outputs.token}}
 
       - name: Download executables
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
@@ -94,15 +103,15 @@ jobs:
       - name: Create and push tag
         shell: bash
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.name '${{steps.app-token.outputs.app-slug}}[bot]'
+          git config --global user.email '${{vars.APP_USER_ID}}+${{steps.app-token.outputs.app-slug}}[bot]@users.noreply.github.com'
           git tag $VERSION
           git push origin $VERSION
 
       - name: Publish release
         shell: cmd
         env:
-          GH_TOKEN: ${{github.token}}
+          GH_TOKEN: ${{steps.app-token.outputs.token}}
         run: |
           gh release create "%VERSION%" ^
             --title "%VERSION%" ^