fix(ci): pass app token via token input for softprops/action-gh-release

[skevetter]

Summary

• softprops/action-gh-release@v3 reads the token from INPUT_TOKEN (populated by the token: action input) before falling back to GITHUB_TOKEN
• The workflow was passing the app-token via env: GITHUB_TOKEN:, which sets GITHUB_TOKEN but not INPUT_TOKEN
• So the action used the default ${{ github.token }} (the low-permissions workflow token) instead of the app-token, causing the 403 "Resource not accessible by integration"
• Fix: pass the app-token via with: token: so INPUT_TOKEN gets the correct value

Summary by CodeRabbit

• Chores
  • Updated release workflow configuration for improved security handling.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	4416810
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a0b7cd91f64520008ebb8ad

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ad341385-13ed-406e-b41e-32e90a3ebbe2

📥 Commits

Reviewing files that changed from the base of the PR and between c0c5295 and 4416810.

📒 Files selected for processing (1)

• .github/workflows/promote-release.yml

---

📝 Walkthrough

Walkthrough

The promote-release workflow's stable release creation step is updated to pass GitHub App token authentication through the action's with.token input parameter rather than via environment variable, while all other release configuration (tag, commit, name, body, and flags) remains unchanged.

Changes

Release Workflow Token Authentication

Layer / File(s)	Summary
Release action token authentication .github/workflows/promote-release.yml	The softprops/action-gh-release@v3 step's authentication is updated to pass with.token from the GitHub App token output instead of setting env.GITHUB_TOKEN; other release parameters remain unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• devsy-org/devsy#353: Both PRs modify the same GitHub workflow step (softprops/action-gh-release@v3) to adjust release-creation authentication parameters.
• devsy-org/devsy#324: Both PRs modify GitHub Actions release workflows to make softprops/action-gh-release@v3 succeed by adjusting authorization setup.
• devsy-org/devsy#326: Both PRs change GitHub release publishing workflow usage of softprops/action-gh-release@v3 for release artifact handling.

Suggested labels

size/xs

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: passing the GitHub App token via the token input parameter instead of environment variable for the softprops/action-gh-release action.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Warning

Review ran into problems

🔥 Problems

Stopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a @coderabbit review after the pipeline has finished.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}