From 5dd537f7da5a4e3350790e02452fae97df4204f9 Mon Sep 17 00:00:00 2001
From: Aleksandr Cupacenko <apaxuc@gmail.com>
Date: Sun, 9 Aug 2026 21:44:58 +0300
Subject: [PATCH] Use GitHub App token to publish releases

---
 .github/workflows/release.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3d49b32..73fdba4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ on:
         type: string
 
 permissions:
-  contents: write
+  contents: read
   packages: write
   id-token: write
   attestations: write
@@ -198,6 +198,14 @@ jobs:
             echo "\`${IMAGE}@${DIGEST}\`"
           } >> "$GITHUB_STEP_SUMMARY"
 
+      - name: Generate GitHub App token
+        id: release-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+
       - name: Publish GitHub release
         uses: actions/github-script@v9
         env:
@@ -212,6 +220,7 @@ jobs:
           DIGEST: ${{ steps.build.outputs.digest }}
           ATTESTATION_URL: ${{ steps.attest.outputs.attestation-url }}
         with:
+          github-token: ${{ steps.release-token.outputs.token }}
           script: |
             const tag = process.env.TAG;
             const tool = process.env.TOOL;