From a1e2598ef28a80a15349e601ce88253405fabfdd Mon Sep 17 00:00:00 2001
From: Luke <conway220@gmail.com>
Date: Sun, 19 Jul 2026 14:50:29 -0400
Subject: [PATCH 1/2] ci: use GitHub App for releases

---
 .github/RELEASE_APP.md   | 23 +++++++++++++++++++++++
 .github/workflows/ci.yml | 13 +++++++++++--
 2 files changed, 34 insertions(+), 2 deletions(-)
 create mode 100644 .github/RELEASE_APP.md

diff --git a/.github/RELEASE_APP.md b/.github/RELEASE_APP.md
new file mode 100644
index 00000000..bd266bd0
--- /dev/null
+++ b/.github/RELEASE_APP.md
@@ -0,0 +1,23 @@
+# Release GitHub App
+
+Releases use a GitHub App installation token instead of a personal access
+token. The App token is short-lived and lets Python Semantic Release commit the
+version and changelog, push the release tag, and create the GitHub release.
+
+## Organization setup
+
+1. Create a GitHub App owned by the `Python-roborock` organization.
+2. Disable webhooks and grant the App **Contents: Read and write** repository
+   permission. No other optional repository or organization permissions are
+   required.
+3. Install the App only on the `python-roborock` repository.
+4. In the `main` branch protection settings, add the App to **Allow specified
+   actors to bypass required pull requests**. Without this bypass,
+   semantic-release cannot commit the generated release files back to `main`.
+5. Add the App's client ID as the repository variable
+   `RELEASE_APP_CLIENT_ID`.
+6. Generate a private key for the App and save the complete PEM file as the
+   `release` environment secret `RELEASE_APP_PRIVATE_KEY`.
+
+After a successful release using the App, remove the old maintainer-owned
+`GH_TOKEN` repository secret.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f2dfd23c..a256ce70 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -127,11 +127,20 @@ jobs:
       with:
         fetch-depth: 0
         persist-credentials: false
+    - name: Create release GitHub App token
+      id: release-token
+      uses: actions/create-github-app-token@v3
+      with:
+        client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+        private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+        permission-contents: write
     - name: Python Semantic Release
       id: release
       uses: python-semantic-release/python-semantic-release@v10.5.3
       with:
-        github_token: ${{ secrets.GH_TOKEN }}
+        # The release App is allowed to bypass the pull-request requirement so
+        # semantic-release can commit the version and changelog back to main.
+        github_token: ${{ steps.release-token.outputs.token }}
         changelog: true
 
     - name: Publish package distributions to PyPI
@@ -148,5 +157,5 @@ jobs:
       uses: python-semantic-release/publish-action@v10.5.3
       if: steps.release.outputs.released == 'true'
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        github_token: ${{ steps.release-token.outputs.token }}
         tag: ${{ steps.release.outputs.tag }}

From f5518091fe060b350f8aa21f16a9460c7f1e7cd7 Mon Sep 17 00:00:00 2001
From: Luke Lashley <conway220@gmail.com>
Date: Sun, 19 Jul 2026 15:17:34 -0400
Subject: [PATCH 2/2] chore: delete slop md

---
 .github/RELEASE_APP.md | 23 -----------------------
 1 file changed, 23 deletions(-)
 delete mode 100644 .github/RELEASE_APP.md

diff --git a/.github/RELEASE_APP.md b/.github/RELEASE_APP.md
deleted file mode 100644
index bd266bd0..00000000
--- a/.github/RELEASE_APP.md
+++ /dev/null
@@ -1,23 +0,0 @@
-# Release GitHub App
-
-Releases use a GitHub App installation token instead of a personal access
-token. The App token is short-lived and lets Python Semantic Release commit the
-version and changelog, push the release tag, and create the GitHub release.
-
-## Organization setup
-
-1. Create a GitHub App owned by the `Python-roborock` organization.
-2. Disable webhooks and grant the App **Contents: Read and write** repository
-   permission. No other optional repository or organization permissions are
-   required.
-3. Install the App only on the `python-roborock` repository.
-4. In the `main` branch protection settings, add the App to **Allow specified
-   actors to bypass required pull requests**. Without this bypass,
-   semantic-release cannot commit the generated release files back to `main`.
-5. Add the App's client ID as the repository variable
-   `RELEASE_APP_CLIENT_ID`.
-6. Generate a private key for the App and save the complete PEM file as the
-   `release` environment secret `RELEASE_APP_PRIVATE_KEY`.
-
-After a successful release using the App, remove the old maintainer-owned
-`GH_TOKEN` repository secret.