[Backport 3.7] Use github default token for releases

[opensearch-ci-bot]

Backport f254369 from #22397.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 5a27f7f.

Path	Line	Severity	Description
.github/workflows/auto-release.yml	14	high	Removal of the 'tibdex/github-app-token' action dependency. Per mandatory flagging rules, all dependency additions, removals, or version changes must be flagged. Maintainers should verify this removal is intentional and that no pinned-hash substitution is being staged in a follow-up commit.
.github/workflows/auto-release.yml	22	low	The release action now falls back to the implicit default GITHUB_TOKEN instead of an explicitly scoped GitHub App token. The App token may have had tighter permission scopes or audit-log attribution; switching to the default token may reduce traceability and widen the effective token scope used during releases. Confirm this is the intended authentication model.

The table above displays the top 10 most important findings.

Total: 2 | Critical: 0 | High: 1 | Medium: 0 | Low: 1

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ Recommended focus areas for review Missing Token Permission The ncipollo/release-action step no longer receives an explicit github_token, relying on the default GITHUB_TOKEN. The workflow's permissions block only grants contents: write, which is required for creating releases, so this should work. However, note that the default GITHUB_TOKEN does not trigger downstream workflows on release events, unlike the previous GitHub App token. If any workflow was listening on the release event to run follow-up automation, it will no longer be triggered after this change. if: github.repository == 'opensearch-project/OpenSearch' permissions: contents: write steps: - name: Get tag id: tag uses: dawidd6/action-get-tag@727a6f0a561be04e09013531e73a3983a65e3479 # v1 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 with: bodyFile: release-notes/opensearch.release-notes-${{steps.tag.outputs.tag}}.md

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
General	Explicitly pass the default GitHub token The ncipollo/release-action requires a token to authenticate against the GitHub API. After removing the GitHub App token, explicitly pass the default GITHUB_TOKEN via github_token: ${{ secrets.GITHUB_TOKEN }} (or token:) to ensure the action can create the release, and to make the intent clear. Also confirm the workflow-level permissions: contents: write is sufficient for creating releases in this repo. .github/workflows/auto-release.yml [20-22] - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 with: + github_token: ${{ secrets.GITHUB_TOKEN }} bodyFile: release-notes/opensearch.release-notes-${{steps.tag.outputs.tag}}.md Suggestion importance[1-10]: 5 __ Why: The ncipollo/release-action defaults to using GITHUB_TOKEN automatically, so explicitly passing it is not strictly necessary but improves clarity. The suggestion is reasonable but of moderate importance.	Low