PYTHON-6076 Request workflows permission in create-release-branch

[blink1073]

PYTHON-6076

Changes in this PR

The Create Release Branch workflow fails at the push step because the Prep branch commit edits .github/workflows/release-python.yml, and the App token minted by secure-checkout@v3 does not request workflows permission. GitHub rejects the push with GH013.

• Replaced secure-checkout@v3 with actions/create-github-app-token@v3, requesting workflows: write in addition to contents and pull-requests.
• Added actions/checkout@v7 with persist-credentials: false.
• Added a step that configures git push auth from GH_TOKEN. setup@v3 only sets user.name/user.email, and the third-party bump-version push step depends on checkout-configured credentials.

Test Plan

Rerun the Create Release Branch workflow with branch_name=v4.18, version=4.18.1.dev0, base_ref=main and confirm the v4.18 branch is created and pushed. Validated locally by pre-commit's "Validate GitHub Workflows" hook.

Checklist

Checklist for Author

• Did you update the changelog (if necessary)? N/A: internal release workflow, no user-facing change.
• Is there test coverage? N/A: workflow change; verified by the workflow validator and a live run.
• Is any followup work tracked in a JIRA ticket? If so, add link(s). PYTHON-6076.

Checklist for Reviewer

• Does the title of the PR reference a JIRA Ticket?
• Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
• Is all relevant documentation (README or docstring) updated?

[Copilot]

🟡 Changes recommended

The workflow currently risks leaking the derived Authorization header (and potentially the token) to logs due to bash -x, and it also deviates from the repo’s pinned actions/checkout versioning convention.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the Create Release Branch GitHub Actions workflow so the workflow can successfully push a branch even when the preparatory commit modifies workflow files (requiring workflows: write on the pushing token).

Changes:

• Replace secure-checkout@v3 with actions/create-github-app-token@v3 to mint a GitHub App installation token that includes workflows: write.
• Add an explicit actions/checkout step (with persist-credentials: false) and configure git push authentication via GH_TOKEN.

File summaries

File	Description
.github/workflows/create-release-branch.yml	Switch to an App installation token with workflows permission; adjust checkout and git auth to enable pushing changes that touch workflow files.

Review details

Suppressed comments (1)

.github/workflows/create-release-branch.yml:57

• This command computes a base64-encoded Authorization header containing the App token; with the job default shell: bash -eux {0}, xtrace will log the fully-expanded header (including the base64 token) to the workflow logs. Disable -x for this step and build the header without echoing it.

      - name: Configure git auth for push
        run: |
          git config --local http.https://github.com/.extraheader \
            "AUTHORIZATION: basic $(printf '%s' "x-access-token:${GH_TOKEN}" | base64 -w0)"

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The new git auth step currently contains a shell-quoting bug that will break the workflow when configuring the push authorization header.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

🟢 Approval recommended

The workflow change is narrowly scoped to fixing GH013 by requesting the correct token permissions and explicitly configuring push authentication.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite

[aclark4life]

I think we can drop persist-credentials: false and Configure git auth for push because actions/checkout already writes the auth header so we don't need to not-save it and then re-create it.

[blink1073]

We don't want the auth stored on disk