Enhance CI workflows with GitHub App tokens and centralized publishing

[arturcic]

Goal

Define and enforce a consistent CI/CD publishing policy for GitVersion so release-oriented automation runs only in approved contexts and uses scoped credentials.

Scope

• CI workflow gating for publish-capable paths.
• Reusable workflow inputs to control publish behavior (images, manifests, packages, coverage).
• Credential flow hardening for publishing actions and downstream dispatches.

Expected Outcome

• Publishing and credential-loading steps are skipped outside approved contexts.
• Authentication uses repository token or app-scoped credentials where applicable.
• External ecosystem update flows follow explicit ownership boundaries.

Non-Goals

• Functional changes to version calculation or release artifacts.
• Broad redesign of build/test orchestration outside publish policy and credential handling.

Resolves #4877

[Copilot]

Pull request overview

This PR updates the repository’s GitHub Actions release/publish automation to use GitHub App–based auth and centralized secret retrieval (via gittools/cicd/*-creds actions), while also adding a single “can publish” flag to consistently gate publishing behavior across reusable workflows.

Changes:

• Introduces GitHub App token generation (via gittools/cicd/gh-app-creds@main + actions/create-github-app-token@v3) for Homebrew/Winget/GitTools Actions update workflows and switches those flows off of RELEASE_GITHUB_TOKEN.
• Adds a publish_flags job in CI and threads boolean publish inputs into reusable workflows to control coverage uploads, Docker publishing, and package publishing.
• Moves DockerHub/NuGet/Chocolatey credentials acquisition to dedicated gittools/cicd/*-creds@main steps and standardizes on ${{ github.token }} where appropriate.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/winget.yml	Switches Winget manifest bump flow to GitHub App token auth (and passes it via GITHUB_TOKEN).
.github/workflows/release.yml	Uses ${{ github.token }} for repository dispatch and formats payload as JSON block; adjusts outputs naming.
.github/workflows/homebrew.yml	Uses GitHub App token auth for Homebrew formula bumping and targets a specific push-to repository.
.github/workflows/gittools-actions.yml	Uses GitHub App token auth to dispatch release-published events to the actions repo.
.github/workflows/docs.yml	Replaces secrets.GITHUB_TOKEN usage with ${{ github.token }} for remark-lint.
.github/workflows/ci.yml	Adds publish_flags gating and wires publish booleans into reusable workflows; switches to credential loader for DockerHub in release job.
.github/workflows/_unit_tests.yml	Adds publish_coverage input and gates Codecov uploads on that boolean.
.github/workflows/_publish.yml	Adds publish_packages input and loads NuGet/Chocolatey creds only when publishing is enabled.
.github/workflows/_docker.yml	Adds publish_images input and uses it to decide between docker test vs publish; loads DockerHub creds via credential loader.
.github/workflows/_docker_manifests.yml	Adds publish_manifests input to conditionally run manifest publishing and load DockerHub creds via credential loader.

[Copilot]

Pull request overview

Updates GitHub Actions workflows to use GitHub App–issued tokens and centrally-gated “can publish” flags, while moving secret retrieval to shared gittools/cicd/*-creds actions for release/publish operations.

Changes:

• Add GitHub App credential loading + installation token generation for Winget/Homebrew/GitTools Actions automation.
• Introduce a publish_flags job in CI and plumb boolean inputs through reusable workflows to control publishing (coverage, docker images/manifests, packages).
• Standardize on ${{ github.token }} in multiple workflows and load DockerHub/NuGet/Chocolatey credentials via gittools/cicd/*-creds@v1.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/winget.yml	Switch Winget publishing to use a GitHub App token (and remove explicit token arg).
.github/workflows/release.yml	Use workflow github.token (with permissions) to dispatch the CI release event; payload formatting cleanup.
.github/workflows/homebrew.yml	Use a GitHub App token and target push-to fork/org for Homebrew bump automation.
.github/workflows/gittools-actions.yml	Use a GitHub App token for dispatching updates to the actions repo.
.github/workflows/docs.yml	Replace secrets.GITHUB_TOKEN usage with ${{ github.token }} for remark-lint.
.github/workflows/ci.yml	Add publish gating via publish_flags; switch DockerHub creds retrieval to gittools/cicd/dockerhub-creds@v1; update dispatch token usage.
.github/workflows/_unit_tests.yml	Add publish_coverage input and gate Codecov uploads on it.
.github/workflows/_publish.yml	Add publish_packages input; load NuGet/Chocolatey creds via gittools/cicd/*-creds@v1; gate publish step.
.github/workflows/_docker.yml	Add publish_images input; gate test vs publish and load DockerHub creds via gittools/cicd/dockerhub-creds@v1.
.github/workflows/_docker_manifests.yml	Add publish_manifests input; gate entire job; load DockerHub creds via gittools/cicd/dockerhub-creds@v1.

[Copilot]

Pull request overview

Updates the repository’s GitHub Actions release/publish automation to use GitHub App tokens and 1Password-sourced credentials, while centralizing “can publish” gating logic to reduce risk on forks/non-main refs.

Changes:

• Replace RELEASE_GITHUB_TOKEN usage with GitHub App tokens (Winget/Homebrew/GitTools Actions) and ${{ github.token }} where appropriate.
• Introduce a publish_flags job in ci.yml and thread boolean publish inputs into reusable workflows to control coverage upload, package publishing, and Docker publish/manifest creation.
• Switch DockerHub/NuGet/Chocolatey credentials loading to gittools/cicd/*-creds@v1 actions gated behind publish flags.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/winget.yml	Uses GitHub App token (via 1Password) for Winget manifest updates; removes explicit token arg from komac invocation.
.github/workflows/release.yml	Uses ${{ github.token }} for repository dispatch and cleans up payload formatting/output naming.
.github/workflows/homebrew.yml	Uses GitHub App token (via 1Password) for Homebrew formula bumping and sets explicit push-to target.
.github/workflows/gittools-actions.yml	Uses GitHub App token (via 1Password) to dispatch update events to the actions repo.
.github/workflows/docs.yml	Uses ${{ github.token }} instead of secrets.GITHUB_TOKEN for remark-lint.
.github/workflows/ci.yml	Adds publish gating job/output; threads publish booleans into reusable workflows; gates DockerHub credential usage behind publish condition.
.github/workflows/_unit_tests.yml	Adds publish_coverage input and uses it to control Codecov uploads.
.github/workflows/_publish.yml	Adds publish_packages input; loads NuGet/Chocolatey creds via 1Password only when publishing.
.github/workflows/_docker.yml	Adds publish_images input; loads DockerHub creds and publishes only when enabled, otherwise runs docker tests.
.github/workflows/_docker_manifests.yml	Adds publish_manifests input and gates the manifest job accordingly; loads DockerHub creds from 1Password.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mergify]

Thank you @arturcic for your contribution!