Switch to using the repository token for release creation

[offbyone]

This eliminates the need for a manually managed GH_TOKEN secret; the only scope needed by autopub[github] is the repo scope, which is covered by contents: write in the workflow

[justinmayer]

@offbyone: I get the impression this did not function as anticipated: https://github.com/pelican-plugins/photos/actions/runs/6697983473/job/18199065950#step:6:40

For now I will probably publish 1.5.0 to PyPI manually, because as it stands now, this is in a half-released state.

[offbyone]

That is very much not what I'd expect!

I'm not 100% sure how to try it out either :/

[justinmayer]

Best way to test it would be to do so in a dummy repository and then push a package to test.pypi.org. I've used that flow when I originally created AutoPub. If you want, I can give you access to the relevant repository/repositories: https://github.com/autopub

[offbyone]

Happy to; I'll experiment in there until it's working.

(Might not get to it til tomorrow night; I'm a bit busy today, if that's okay)

[justinmayer]

No worries. I sent you an invitation to the test repo I've used in the past.

[offbyone]

Well, at least I can replicate it in the autopub project, but I am utterly confused as to WTF is happening.

[offbyone]

I've submitted a support request on it; hopefully I can figure out why this is happening.

[justinmayer]

That's great. Thanks for looking deeper into that. I'm wondering if it has something to do with token format. Maybe the GitHub-release project currently only supports "classic" personal access tokens, and the built-in GITHUB_TOKEN token is… not that? I'm really just grasping at straws, though.

[offbyone]

We found the issue: scikit-build/github-release#73

[justinmayer]

@offbyone: While we are waiting for a new githubrelease package containing the above-mentioned fix, I have taken the liberty of forking that project in order to work around a problem I ran into when trying to install the current master branch. I just did a test over in the test repository using that fork+branch (relevant commit: autopub/test-github-ci@2fb9904), and it seems that it works now: https://github.com/autopub/test-github-ci/actions/runs/7757008090/job/21155593033

[offbyone]

I'm in favour of vendoring it, under the circumstances.