## Problem
The `Publish release` step fails with `HTTP 403: Resource not accessible
by integration` because the default `GITHUB_TOKEN` cannot create the
release tag under the active tag-create protection ruleset.
## Change
Use a dedicated GitHub App token for the `Publish release` step:
- Add a `Generate release App token` step using `secrets.RELEASE_APP_ID`
/ `secrets.RELEASE_APP_PRIVATE_KEY`.
- Switch only that step's `GITHUB_TOKEN` to the minted App token.
## Required before merge (admin)
1. Create the release GitHub App (least privilege) and install it on
`coder/coder`.
2. Configure `RELEASE_APP_ID` / `RELEASE_APP_PRIVATE_KEY`.
3. Add the App to the tag-create protection ruleset bypass list.
Refs coder/security-automation#297.
Jakub Domeracki
be9f8592eb