ci: use gh app

.github/workflows/release.yml

@@ -132,19 +132,26 @@ jobs:
     runs-on: ubuntu-latest
     needs: build-core
     steps:
+      - name: Create GitHub App token
+        id: app_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.GH_PAT }}
+          token: ${{ steps.app_token.outputs.token }}
           fetch-depth: 0
 
       - name: Update VERSION
         env:
-          GH_PAT: ${{ secrets.GH_PAT }}
+          GH_TOKEN: ${{ steps.app_token.outputs.token }}
         run: |
           set -euo pipefail
-          git config user.name "dms-ci"
-          git config user.email "dms-ci@users.noreply.github.com"
+          git config user.name "dms-ci[bot]"
+          git config user.email "dms-ci[bot]@users.noreply.github.com"
 
           version="${GITHUB_REF#refs/tags/}"
           echo "Updating to version: $version"
@@ -153,11 +160,12 @@ jobs:
 
           if ! git diff --cached --quiet; then
             git commit -m "chore: bump version to $version"
-            git push https://x-access-token:${GH_PAT}@github.com/${{ github.repository }}.git HEAD:master
+            git pull --rebase origin master
+            git push https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git HEAD:master
           fi
 
           git tag -f "${version}"
-          git push -f https://x-access-token:${GH_PAT}@github.com/${{ github.repository }}.git "${version}"
+          git push -f https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git "${version}"
 
   release:
     runs-on: ubuntu-24.04