Use only GH_TOKEN for app-auth steps

For GitHub App-enabled workflow/action paths, remove dual-token env usage and keep explicit GH_TOKEN-only wiring with no github.token fallback.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

.github/actions/Cleanup-PSModulePrereleases/action.yml

@@ -28,7 +28,6 @@ runs:
       working-directory: ${{ inputs.WorkingDirectory }}
       env:
         GH_TOKEN: ${{ env.GH_TOKEN }}
-        GITHUB_TOKEN: ${{ env.GITHUB_TOKEN }}
         PSMODULE_CLEANUP_PSMODULEPRERELEASES_INPUT_WhatIf: ${{ inputs.WhatIf }}
         PSMODULE_CLEANUP_PSMODULEPRERELEASES_CONTEXT_ReleaseTag: ${{ env.PSMODULE_PUBLISH_PSMODULE_CONTEXT_ReleaseTag }}
       run: ${{ github.action_path }}/src/cleanup.ps1

.github/actions/Get-PSModuleSettings/action.yml

@@ -54,7 +54,6 @@ runs:
       id: Get-PSModuleSettings
       env:
         GH_TOKEN: ${{ env.GH_TOKEN }}
-        GITHUB_TOKEN: ${{ env.GITHUB_TOKEN }}
         PSMODULE_GET_SETTINGS_INPUT_Name: ${{ inputs.Name }}
         PSMODULE_GET_SETTINGS_INPUT_SettingsPath: ${{ inputs.SettingsPath }}
         PSMODULE_GET_SETTINGS_INPUT_Debug: ${{ inputs.Debug }}
@@ -65,7 +64,7 @@ runs:
         PSMODULE_GET_SETTINGS_INPUT_ImportantFilePatterns: ${{ inputs.ImportantFilePatterns }}
       with:
         Name: Get-PSModuleSettings
-        Token: ${{ env.GITHUB_TOKEN }}
+        Token: ${{ env.GH_TOKEN }}
         ShowInfo: false
         ShowOutput: true
         Debug: ${{ inputs.Debug }}

.github/actions/Publish-PSModule/action.yml

@@ -59,7 +59,6 @@ runs:
       working-directory: ${{ inputs.WorkingDirectory }}
       env:
         GH_TOKEN: ${{ env.GH_TOKEN }}
-        GITHUB_TOKEN: ${{ env.GITHUB_TOKEN }}
         PSMODULE_PUBLISH_PSMODULE_INPUT_Name: ${{ inputs.Name }}
         PSMODULE_PUBLISH_PSMODULE_INPUT_ModulePath: ${{ inputs.ModulePath }}
         PSMODULE_PUBLISH_PSMODULE_INPUT_APIKey: ${{ inputs.APIKey }}

.github/actions/Resolve-PSModuleVersion/action.yml

@@ -66,7 +66,6 @@ runs:
       working-directory: ${{ inputs.WorkingDirectory }}
       env:
         GH_TOKEN: ${{ env.GH_TOKEN }}
-        GITHUB_TOKEN: ${{ env.GITHUB_TOKEN }}
         PSMODULE_RESOLVE_PSMODULEVERSION_INPUT_Settings: ${{ inputs.Settings }}
         PSMODULE_RESOLVE_PSMODULEVERSION_INPUT_Name: ${{ inputs.Name }}
         PSMODULE_RESOLVE_PSMODULEVERSION_INPUT_EventJson: ${{ inputs.EventJson }}

.github/workflows/Plan.yml

@@ -99,7 +99,6 @@ jobs:
         id: Get-Settings
         env:
           GH_TOKEN: ${{ steps.App-Token.outputs.token }}
-          GITHUB_TOKEN: ${{ steps.App-Token.outputs.token }}
         with:
           SettingsPath: ${{ inputs.SettingsPath }}
           Debug: ${{ inputs.Debug }}
@@ -114,7 +113,6 @@ jobs:
         id: Resolve-Version
         env:
           GH_TOKEN: ${{ steps.App-Token.outputs.token }}
-          GITHUB_TOKEN: ${{ steps.App-Token.outputs.token }}
         with:
           Settings: ${{ steps.Get-Settings.outputs.Settings }}
           Name: ${{ fromJson(steps.Get-Settings.outputs.Settings).Name }}

.github/workflows/Publish-Module.yml

@@ -55,7 +55,6 @@ jobs:
         uses: ./_wf/.github/actions/Publish-PSModule
         env:
           GH_TOKEN: ${{ steps.App-Token.outputs.token }}
-          GITHUB_TOKEN: ${{ steps.App-Token.outputs.token }}
         with:
           Name: ${{ fromJson(inputs.Settings).Name }}
           ModulePath: outputs/module
@@ -71,7 +70,6 @@ jobs:
         uses: ./_wf/.github/actions/Cleanup-PSModulePrereleases
         env:
           GH_TOKEN: ${{ steps.App-Token.outputs.token }}
-          GITHUB_TOKEN: ${{ steps.App-Token.outputs.token }}
         with:
           WhatIf: ${{ github.repository == 'PSModule/Process-PSModule' }}
           AutoCleanup: ${{ fromJson(inputs.Settings).Publish.Module.AutoCleanup }}

README.md

@@ -30,4 +30,4 @@ jobs:
       GitHubAppPrivateKey: ${{ secrets.PSMODULE_PRIVATE_KEY }}
 ```
 
-This is a required contract for GitHub operations in the reusable workflow path; `github.token` fallback is intentionally not used.
+This is a required contract for GitHub operations in the reusable workflow path; a GitHub App installation token is minted and used for those steps via `GH_TOKEN`, and `github.token` fallback is intentionally not used.