add gh app, use verified-bot-commit

[andrew-fleming]

This PR proposes to:

• Integrate GH app
• Replace auto-commit with verified-bot-commit
• Add manual tag + push tag step

Summary by CodeRabbit

• Chores
  • Updated internal CI/CD pipeline infrastructure to improve release process reliability and automation.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

Walkthrough

The release workflow is refactored to use GitHub App authentication for repository access. The commit-and-tag action is split into two distinct steps: one for committing version bumps to specific files, and another for creating and pushing git tags. The checkout step now incorporates the GitHub App token.

Changes

Cohort / File(s)	Summary
Release workflow refactoring .github/workflows/release.yml	Introduces GitHub App token acquisition and integrates it into checkout. Replaces single "Commit and tag version bump" action with two separate steps: "Commit version bump" (using verified-bot-commit action with token auth and per-file commit targeting) and "Create and push tag" (explicit tag creation and push). Removes file_pattern and tagging_message parameters in favor of files list.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Add release #43: Directly related workflow modification that similarly refactored the release flow by replacing a single commit+tag action with GitHub App–authenticated checkout, per-file commit step, and explicit tag creation/push.

Suggested reviewers

• emnul
• son-oz

Poem

🐰 A token hops forth, then splits the work in two,
First committing changes, clean and swift and true,
Then tagging follows, pushing to the sky,
Our release pipeline takes a nimble fly! 🏷️

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly references the two main changes: integrating a GitHub App ('add gh app') and replacing the commit action ('use verified-bot-commit'), which align with the PR objectives and the substantial workflow modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[0xisk]

Looks good 👌 Thank you @andrew-fleming !

[emnul]

Thanks for adding this!