[mvantellingen]

Problem

changesets/action opens the "Release new version" PR and pushes the changeset-release/main branch with the default GITHUB_TOKEN. GitHub does not trigger workflows for events created by GITHUB_TOKEN, so runs on that PR sit at action_required (e.g. labd/js-toolkit#12, labd/intl-extractor#26) and the required org Security Checks never complete, which blocks the merge.

Fix

• Add a step that mints an installation token for the org GitHub App lab-digital-release-bot (actions/create-github-app-token, SHA-pinned v3.3.0) using vars.RELEASE_APP_ID / secrets.RELEASE_APP_PRIVATE_KEY, scoped to contents: write and pull-requests: write.
• Pass it to changesets/action via github-token. The action uses that token for the API calls, for the release branch / tag pushes (with push-with-git-cli it injects it as a command-scoped http.extraHeader, so checkout credentials are not needed), and exports it as GITHUB_TOKEN to the version/publish scripts.
• Remove the GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} env on the changesets step where present: v2 errors out when that env differs from github-token.

npm trusted publishing (OIDC), environment: release, checkout settings and caching are unchanged.

[changeset-bot]

⚠️ No Changeset found

Latest commit: eb414be

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR