fix: use kernel-internal app token for release workflow

[rgarcia]

Summary

• Switch release workflow from GITHUB_TOKEN to kernel-internal GitHub App token
• Ensures releases created by this workflow can trigger downstream workflows if needed

Changes

• Added actions/create-github-app-token@v1 step to generate app token
• Replaced all secrets.GITHUB_TOKEN references with the app token for release creation and asset uploads

---

Note

Medium Risk
Changes the authentication mechanism used to create releases and upload assets; misconfigured App secrets/permissions could break releases or alter automation trigger behavior.

Overview
Updates .github/workflows/release.yaml to generate a GitHub App installation token via actions/create-github-app-token@v1 and use it for actions/create-release@v1 plus all actions/upload-release-asset@v1 steps.

Replaces all secrets.GITHUB_TOKEN usage with the app token (sourced from ADMIN_APP_ID/ADMIN_APP_PRIVATE_KEY) so releases and uploaded artifacts are attributed to—and can trigger workflows as—the GitHub App.

^{Written by Cursor Bugbot for commit f356574. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

• ✅ Fixed: App token may expire before release steps execute
  • Moved the app token generation step from the beginning of the workflow to just before the 'Create release' step, so the 1-hour token is generated after all kernel builds complete and right before it is needed.

Or push these changes by commenting:

@cursor push cf6bcc22ad

Preview (cf6bcc22ad)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -7,12 +7,6 @@
     name: Release
     runs-on: ubuntu-22.04
     steps:
-     - name: Generate app token
-       id: app-token
-       uses: actions/create-github-app-token@v1
-       with:
-         app-id: ${{ secrets.ADMIN_APP_ID }}
-         private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
      - name: Code checkout
        uses: actions/checkout@v4
        with:
@@ -31,6 +25,12 @@
        run: make ch_defconfig
      - name: Build kernel (x86-64)
        run: CFLAGS="-Wa,-mx86-used-note=no" make bzImage -j `nproc`
+     - name: Generate app token
+       id: app-token
+       uses: actions/create-github-app-token@v1
+       with:
+         app-id: ${{ secrets.ADMIN_APP_ID }}
+         private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
      - name: Create release
        id: create_release
        uses: actions/create-release@v1

[rgarcia]

@cursor push cf6bcc2