fix(ci): isolate releases from shared API rate limits

[t3dotgg]

Recent nightly releases failed while generating GitHub release notes because publication shared the Release App installation API quota, which was exhausted repeatedly.

Publish releases with the job-scoped GITHUB_TOKEN and least-privilege contents access so release API calls use this repository quota. Keep the Release App for the stable finalize push, upgrade action-gh-release to its Node 24 release, and document the credential boundary.

Testing

• vp fmt --check .github/workflows/release.yml docs/operations/release.md
• git diff --check

Generated by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

Low Risk
CI-only credential and action version changes; release publishing still needs contents write on the workflow token, with no application runtime impact.

Overview
GitHub Release publication no longer mints or uses the Release App token. The release job now grants contents: write and passes github.token into softprops/action-gh-release@v3 (upgraded from v2) for both normal and first-release publish steps, so release-note generation and asset uploads draw on this repo’s workflow token quota instead of the shared installation limit that was exhausting on nightlies.

Release App credentials are documented and still used only in finalize for committing aligned package versions to main. Ops docs now state that RELEASE_APP_* secrets are required for stable finalize, not for publishing the GitHub Release itself.

^{Reviewed by Cursor Bugbot for commit 5f2aef9. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Switch release workflow to use default github.token instead of GitHub App token

• Removes the actions/create-github-app-token minting step from release.yml and replaces all references with the default github.token.
• Adds contents: write permission to the release job to authorize the default token for publishing releases.
• Upgrades softprops/action-gh-release from v2 to v3 for both release publication steps.
• Updates release.md to clarify that only the finalize job uses GitHub App credentials; release publication uses the repository-scoped workflow token.

^{Macroscope summarized 5f2aef9.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 31546f10-d6f0-4dc8-b533-1867b887fba5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved 5f2aef9

Minor CI/CD workflow change that switches GitHub Release publication from a custom app token to the built-in workflow token for rate limit isolation. No application runtime impact; only affects CI authentication mechanism.

^{You can customize Macroscope's approvability policy. Learn more.}