fix(ci): use GitHub App token in auto-release workflow

[f-trycua]

Summary

• The release-on-merge.yml workflow was failing with HTTP 403: Resource not accessible by integration when trying to dispatch release-bump-version.yml via gh workflow run
• Root cause: secrets.GITHUB_TOKEN doesn't have permission to trigger workflow dispatches
• Fix: use the same GitHub App token (RELEASE_APP_ID/RELEASE_APP_PRIVATE_KEY) already used by release-bump-version.yml, which has the required actions: write scope

Fixes: https://github.com/trycua/cua/actions/runs/22450965050/job/65018944677

Test plan

• Merge a PR with a release:lume label and verify the auto-release workflow successfully dispatches release-bump-version.yml

Summary by CodeRabbit

• Chores
  • Updated internal release automation workflow with enhanced security measures for authentication in the CI/CD pipeline.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Building	Preview, Comment	Feb 26, 2026 4:24pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b8a4f5a and fd51bac.

📒 Files selected for processing (1)

• .github/workflows/release-on-merge.yml

---

📝 Walkthrough

Walkthrough

The release workflow now uses a GitHub Apps token generated dynamically via actions/create-github-app-token@v1 instead of relying on the default GITHUB_TOKEN. Explicit workflow permissions have been defined, and subsequent steps are updated to consume the generated token.

Changes

Cohort / File(s)	Summary
GitHub Workflow Authentication .github/workflows/release-on-merge.yml	Introduced GitHub Apps token generation step, added explicit workflow permissions (actions: write, contents: read, pull-requests: read), and updated token consumption in existing release detection and labeling step.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A token hops in, fresh and new,
GitHub Apps flow, authentication true,
No secrets borrowed from the store,
Just app-signed power, secure and sure! ✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/auto-release-permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}