ci: publish and document as the riseproject-dev App

The documentation PR is opened from _publish-wheel.yml, so it needs the App
token too, or it keeps landing without checks. A reusable workflow gets no
secret it is not handed, hence the one line in each build workflow.

Author: luhenry

.github/workflows/_publish-wheel.yml

@@ -25,6 +25,12 @@ on:
         required: false
         default: ''
         type: string
+    secrets:
+      app-private-key:
+        description: >-
+          Private key of the riseproject-dev GitHub App. Without it the
+          documentation PR is opened with GITHUB_TOKEN and gets no checks.
+        required: false
 
 concurrency:
   group: publish-wheel
@@ -35,10 +41,22 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
+      # A branch pushed or a PR opened with GITHUB_TOKEN raises no events, so
+      # the documentation PR would sit there with no checks. Push and open it
+      # as the App instead; without its credentials, or on a pull request
+      # (where nothing is published anyway), this falls back to GITHUB_TOKEN.
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+        id: app-token
+        if: ${{ vars.RISEPROJECT_APP_CLIENT_ID != '' && github.ref == 'refs/heads/main' }}
+        with:
+          client-id: ${{ vars.RISEPROJECT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.app-private-key }}
+
       - name: Checkout python-wheels
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
 
       - name: Download wheels
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
@@ -136,7 +154,7 @@ jobs:
       - name: Create draft release and upload assets
         if: github.ref == 'refs/heads/main'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
           RELEASE_TITLE: ${{ steps.release.outputs.title }}
         run: |
@@ -166,7 +184,7 @@ jobs:
       - name: Verify release is immutable
         if: github.ref == 'refs/heads/main'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
         run: |
           immutable=$(gh api \
             "repos/${{ github.repository }}/releases/tags/${{ steps.release.outputs.tag }}" \
@@ -178,7 +196,8 @@ jobs:
 
       - name: Update package documentation
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
           ARTIFACTS_PATH: ${{ inputs.artifact-path }}
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
           GPL_SOURCES_DESCRIPTION: ${{ inputs.gpl-sources-description }}

.github/workflows/build-ada-url.yml

@@ -92,5 +92,7 @@ jobs:
       contents: write
       pull-requests: write
     uses: $/.github/workflows/_publish-wheel.yml
+    secrets:
+      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
     with:
       artifact-pattern: ada-url-${{ matrix.version }}-*-manylinux_riscv64

.github/workflows/build-adbc-driver-manager.yml

@@ -110,5 +110,7 @@ jobs:
       contents: write
       pull-requests: write
     uses: $/.github/workflows/_publish-wheel.yml
+    secrets:
+      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
     with:
       artifact-pattern: adbc-driver-manager-${{ matrix.version }}-*-manylinux_riscv64

.github/workflows/build-adbc-driver-postgresql.yml

@@ -174,5 +174,7 @@ jobs:
       contents: write
       pull-requests: write
     uses: $/.github/workflows/_publish-wheel.yml
+    secrets:
+      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
     with:
       artifact-pattern: adbc-driver-postgresql-${{ matrix.version }}-*-manylinux_riscv64

.github/workflows/build-adbc-driver-sqlite.yml

@@ -165,5 +165,7 @@ jobs:
       contents: write
       pull-requests: write
     uses: $/.github/workflows/_publish-wheel.yml
+    secrets:
+      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
     with:
       artifact-pattern: adbc-driver-sqlite-${{ matrix.version }}-*-manylinux_riscv64

.github/workflows/build-aggdraw.yml

@@ -99,5 +99,7 @@ jobs:
       contents: write
       pull-requests: write
     uses: $/.github/workflows/_publish-wheel.yml
+    secrets:
+      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
     with:
       artifact-pattern: aggdraw-${{ matrix.version }}-*-manylinux_riscv64

.github/workflows/build-ahocorasick-rs.yml

@@ -101,5 +101,7 @@ jobs:
       contents: write
       pull-requests: write
     uses: $/.github/workflows/_publish-wheel.yml
+    secrets:
+      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
     with:
       artifact-pattern: ahocorasick-rs-${{ matrix.version }}-*-manylinux_riscv64

.github/workflows/build-aiocsv.yml

@@ -95,5 +95,7 @@ jobs:
       contents: write
       pull-requests: write
     uses: $/.github/workflows/_publish-wheel.yml
+    secrets:
+      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
     with:
       artifact-pattern: aiocsv-${{ matrix.version }}-*riscv64

.github/workflows/build-aiokafka.yml

@@ -112,5 +112,7 @@ jobs:
       contents: write
       pull-requests: write
     uses: $/.github/workflows/_publish-wheel.yml
+    secrets:
+      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
     with:
       artifact-pattern: aiokafka-${{ matrix.version }}-*-manylinux_riscv64

.github/workflows/build-aioquic.yml

@@ -131,5 +131,7 @@ jobs:
       contents: write
       pull-requests: write
     uses: $/.github/workflows/_publish-wheel.yml
+    secrets:
+      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
     with:
       artifact-pattern: aioquic-${{ matrix.version }}-*-manylinux_riscv64