ci: use GitHub App for Release Please

[jbeckwith-oai]

Summary

• mint a repository-scoped installation token for the openai-sdks GitHub App from environment configuration
• pass that token to Release Please and disable the release job's built-in GITHUB_TOKEN permissions
• remove the manual workflow-dispatch workaround now that release branch pushes and pull-request events trigger Actions normally
• keep API-key-backed example jobs off the automated Release Please branch

Why

Release Please currently authenticates with GITHUB_TOKEN. Events created with that token do not normally start downstream workflows, which required a separate dispatch job and release-specific workflow inputs. A GitHub App installation token triggers the normal push and pull-request workflows, so the workaround can be deleted.

Repository configuration

• verified App: openai-sdks (App ID 3705508, client ID Iv23li2AtcmhLHO07J87)
• dedicated environment: release
• environment variable: OPENAI_SDKS_APP_CLIENT_ID
• environment secret: OPENAI_SDKS_APP_PRIVATE_KEY
• the environment is restricted to main and has no required-reviewer or wait-timer gate

The release environment now contains both App credentials expected by the workflow.

Validation

• ./scripts/lint
• actionlint v1.7.7 on the changed workflows
• git diff origin/main...HEAD --check

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 12.614s for Python SDK PR #3577.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	184ms
tests/chat-completions-create.test.ts	✅ Passed	287ms
tests/chat-completions-stream.test.ts	✅ Passed	152ms
tests/files-content-binary.test.ts	✅ Passed	232ms
tests/files-create-multipart.test.ts	✅ Passed	231ms
tests/files-list-pagination.test.ts	✅ Passed	196ms
tests/initialize-config.test.ts	✅ Passed	208ms
tests/instance-isolation.test.ts	✅ Passed	262ms
tests/models-list.test.ts	✅ Passed	166ms
tests/responses-background-lifecycle.test.ts	✅ Passed	263ms
tests/responses-body-method-errors.test.ts	✅ Passed	419ms
tests/responses-cancel-timeout.test.ts	✅ Passed	220ms
tests/responses-cancel.test.ts	✅ Passed	346ms
tests/responses-compact-retries.test.ts	✅ Passed	450ms
tests/responses-compact.test.ts	✅ Passed	324ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	142ms
tests/responses-create-advanced.test.ts	✅ Passed	305ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.396s
tests/responses-create-errors.test.ts	✅ Passed	220ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	294ms
tests/responses-create-retries.test.ts	✅ Passed	291ms
tests/responses-create-stream-failures.test.ts	✅ Passed	158ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	226ms
tests/responses-create-stream-wire.test.ts	✅ Passed	4.106s
tests/responses-create-stream.test.ts	✅ Passed	296ms
tests/responses-create-terminal-states.test.ts	✅ Passed	304ms
tests/responses-create-timeout.test.ts	✅ Passed	214ms
tests/responses-create.test.ts	✅ Passed	419ms
tests/responses-delete.test.ts	✅ Passed	226ms
tests/responses-input-items-errors.test.ts	✅ Passed	380ms
tests/responses-input-items-list.test.ts	✅ Passed	365ms
tests/responses-input-items-options.test.ts	✅ Passed	357ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	259ms
tests/responses-input-tokens-count.test.ts	✅ Passed	291ms
tests/responses-malformed-inputs.test.ts	✅ Passed	3.229s
tests/responses-not-found-errors.test.ts	✅ Passed	382ms
tests/responses-parse.test.ts	✅ Passed	462ms
tests/responses-retrieve-retries.test.ts	✅ Passed	292ms
tests/responses-retrieve.test.ts	✅ Passed	303ms
tests/responses-stored-method-errors.test.ts	✅ Passed	769ms
tests/retry-behavior.test.ts	✅ Passed	3.186s
tests/sdk-error-shape.test.ts	✅ Passed	391ms

View OkTest run #30862067580

_{SDK merge (2ad0f04991e7) · head (192d12fe7570) · base (5e36cd326fa2) · OkTest (91635c6a2723)}

[HAYDEN-OAI]

Reviewed the complete exact-head diff, all commits and prior discussion, and the surrounding release and CI workflows. Verified that the openai-sdks installation token is scoped to this repository with only the required contents, issues, and pull-request write permissions; the protected credential environment is restricted to main; release-branch protections permit the generated branch; App-created push and pull-request events cover the required checks without recursive releases; API-key-backed examples are excluded from release-branch pushes; and release outputs plus the existing build/publish retry path remain intact. No substantive correctness, security, or reliability issues found.