[mvantellingen]

Problem

changesets/action opens the "Release new version" PR and pushes the changeset-release/main branch with the default GITHUB_TOKEN. GitHub does not trigger workflows for events created by GITHUB_TOKEN, so runs on that PR sit at action_required (e.g. labd/js-toolkit#12, labd/intl-extractor#26) and the required org Security Checks never complete, which blocks the merge.

Fix

• Add a step that mints an installation token for the org GitHub App lab-digital-release-bot (actions/create-github-app-token, SHA-pinned v3.3.0) using vars.RELEASE_APP_ID / secrets.RELEASE_APP_PRIVATE_KEY, scoped to contents: write and pull-requests: write.
• Pass it to changesets/action via github-token. The action uses that token for the API calls, for the release branch / tag pushes (with push-with-git-cli it injects it as a command-scoped http.extraHeader, so checkout credentials are not needed), and exports it as GITHUB_TOKEN to the version/publish scripts.
• Remove the GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} env on the changesets step where present: v2 errors out when that env differs from github-token.

npm trusted publishing (OIDC), environment: release, checkout settings and caching are unchanged.