[CI] CI: use app token for release refs

[gyohuangxin]

Summary

• Generate an aiter GitHub App token in the release prepare job.
• Use the app token for checkout credentials and release-target GitHub CLI calls.
• Reduce the prepare job GITHUB_TOKEN contents permission to read-only; release ref writes now go through the app token that can bypass tag creation rules.

Test plan

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/release-automation.yaml')); print('yaml ok')"
• git diff --check

[github-actions]

🏷️ CI Guide

Runs automatically on every PR:

• ✅ Pre-checks (submodule verification, code formatting)
• ✅ Aiter op tests (gfx942 + gfx950)
• ✅ Triton tests on MI35X (only when aiter/ops/triton/** or related paths are changed)

Extended tests (opt-in via labels):

Label	Tests
ci:gfx1250-ffm-triton	Run the five-shard gfx1250 FFM Triton test suite
ci:triton-300x	Run an additional Triton test job on MI300X in PRs; main branch always runs both MI35X and MI300X
multigpu	Aiter multi-GPU tests on the 8-GPU runner
ci:sglang	SGLang integration tests: DeepSeek-R1-MXFP4 accuracy, Qwen 3.5 accuracy
ci:atom	ATOM benchmark: DeepSeek-R1-0528, GPT-OSS-120B
ci:atom_full	ATOM accuracy suite for PR and main models from ATOM models_accuracy.json
ci:vllm	vLLM benchmark: GPT-OSS-120B, DeepSeek-R1-0528, Kimi-K2.5
ci:all	All standard extended tests (excludes ci:atom_full)

Only add ci:atom_full for FlyDSL or Triton upgrades.
Add labels via the sidebar or gh pr edit 5198 --add-label <label>

PR title tags & labels:
Component tags ([Triton/Gluon], [HIP], [CK], [ASM], ...) are added to the PR title and as PR labels automatically from the changed files and re-synced on every push — change-type tags like [fix]/[Perf], op tags like [MLA], and human labels (ci:*) are left untouched. Add the no-auto-title label to opt this PR out.

[Copilot]

🔵 Needs a closer look

It changes release automation authentication/authorization behavior in ways that depend on external App/secrets configuration that cannot be validated from the diff alone.

Pull request overview

This PR updates the release automation workflow to authenticate release-ref operations using a GitHub App installation token, reducing reliance on the default GITHUB_TOKEN and tightening its permissions in the release preparation job.

Changes:

• Generate a GitHub App token in the prepare job using actions/create-github-app-token@v1.
• Use the App token for actions/checkout and for GitHub CLI calls in the “Resolve release target” step.
• Reduce the prepare job’s contents permission from write to read, shifting ref writes to the App token path.

File summaries

File	Description
.github/workflows/release-automation.yaml	Adds GitHub App token generation and routes checkout/gh authentication through it while tightening prepare job permissions.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The workflow changes correctly scope down GITHUB_TOKEN permissions while switching the ref-writing operations to use the GitHub App token without introducing YAML or logic issues.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite