fix(gha): mint the Go-publish token from the open-constructs-cdktn App

[so0k]

Problem

The release_golang job authenticates with TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN — a user PAT that has expired. GitHub 401s the push, headless git falls back to an interactive password prompt, and the job dies:

fatal: could not read Password for 'https://***@github.com': No such device or address
    Command failed: git push origin cdktn/v0.24.0-pre.95

Both the original publish_next run and a fresh rerun (31085026499) failed identically, so this is credential death, not token-TTL flakiness. This currently blocks the 0.24.0 release cut (#303) — the stable flow publishes Go with the same secret.

Fix

Mint an installation token from the open-constructs-cdktn GitHub App (installation 138220829) whose credentials are already in this repo's secrets (GH_APP_ID / GH_APP_PRIVATE_KEY), scoped to cdk-terrain-go, and use it as GITHUB_TOKEN for publib-golang. Fresh every run, expires in an hour, no PAT to rot. Same pinned create-github-app-token@v2 SHA as release-please.yml / pnpm-upgrade.yml.

If the App installation turns out not to cover cdk-terrain-go, the mint step fails fast with a clear error — fallback is rotating the PAT.

Closes #66 (this was exactly the failure mode that issue predicted).

Verification

Merging this triggers the next pre-release flow on main, which will exercise the new token path end-to-end (expect v0.24.0-pre.96 to land in cdk-terrain-go). A green publish_next / Release Go to Github Repo (next) is the all-clear to merge #303.

🤖 Generated with Claude Code

[sakul-learning]

The App-token implementation in .github/workflows/release-publish.yml:202-217 is pinned, scoped to open-constructs/cdk-terrain-go, and limited to contents: write, so the new Go-publish credential path looks good. One cleanup remains in the reusable-workflow interface: .github/workflows/release-publish.yml:33-34 still declares TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN as required even though release_golang no longer uses it. This means the expired PAT must remain provisioned to satisfy the workflow contract; removing it after this migration can prevent the reusable workflow from being invoked. Please remove that obsolete required-secret declaration. Optionally, declare GH_APP_ID and GH_APP_PRIVATE_KEY as the credentials the workflow now consumes; they are currently available through the callers’ secrets: inherit.

Workflow security scan: 1 changed workflow (.github/workflows/release-publish.yml), 119 findings at the merge-base baseline, 6 findings in this workflow at the PR head, and 0 new or touched findings — ✅ PASS. The remaining findings are pre-existing backlog, not blockers for this PR.

[so0k]

Done in f35a470: TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN is out of the workflow_call contract, and GH_APP_ID/GH_APP_PRIVATE_KEY are declared as the credentials the workflow now consumes (both callers use secrets: inherit, so the swap is transparent). Once this merges, the expired PAT secret can be deleted from the repo settings entirely.

[sakul-learning]

✅ Approved after re-review at f35a4704.

The reusable-workflow secret contract in .github/workflows/release-publish.yml now matches the Go publish implementation: the obsolete TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN requirement is removed, GH_APP_ID and GH_APP_PRIVATE_KEY are declared as required, and both callers provide them through secrets: inherit. The App token remains SHA-pinned, restricted to open-constructs/cdk-terrain-go, and limited to contents: write.

The latest delta passes git diff --check, applicable CI checks are green, and the baseline-versus-head workflow security comparison found no new findings. No remaining blockers found.