ci(release): add fine-grained PAT fallback for GitHub release job and cover in contract tests

Author: farhan-syah

.github/workflows/release.yml

@@ -276,6 +276,7 @@ jobs:
     needs: [validate, provenance]
     if: inputs.github
     runs-on: ubuntu-latest
+    environment: github
     permissions:
       contents: write
       actions: read
@@ -292,7 +293,10 @@ jobs:
       - name: Create or update exact GitHub release
         shell: bash
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Organization policy may cap GITHUB_TOKEN at read-only even when this
+          # job requests contents: write. A fine-grained token scoped to this
+          # repository provides the protected-environment fallback.
+          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN || github.token }}
           TAG: ${{ inputs.tag }}
           VERSION: ${{ needs.validate.outputs.version }}
           PRERELEASE: ${{ needs.validate.outputs.is_prerelease }}

scripts/release/tests/test_contracts.py

@@ -243,8 +243,12 @@ def test_distribution_provenance_source_and_no_build_contracts(self):
         self.assertEqual(publish_step["env"]["NODE_AUTH_TOKEN"], "${{ secrets.NPM_TOKEN }}")
         self.assertIn("npm publish \"$tarball\" --access public --provenance", publish_step["run"])
         self.assertLess(text.index('for file in "${platform_tarballs[@]}"'), text.index('publish "${roots[0]}"'))
-        self.assertEqual(release["jobs"]["github-release"]["steps"][0]["uses"], "actions/checkout@v6")
-        self.assertEqual(release["jobs"]["github-release"]["steps"][0]["with"]["ref"], "${{ inputs.tag }}")
+        github = release["jobs"]["github-release"]
+        self.assertEqual(github["environment"], "github")
+        self.assertEqual(github["steps"][0]["uses"], "actions/checkout@v6")
+        self.assertEqual(github["steps"][0]["with"]["ref"], "${{ inputs.tag }}")
+        release_step = next(step for step in github["steps"] if step.get("name") == "Create or update exact GitHub release")
+        self.assertEqual(release_step["env"]["GH_TOKEN"], "${{ secrets.GH_RELEASE_TOKEN || github.token }}")
         self.assertIn('gh release create "$TAG" "${files[@]}" --verify-tag --target "$SHA"', text)
         self.assertIn('test "$(jq -r .target_commitish <<<"$release_json")" = "$SHA"', text)
         self.assertNotIn(".head_branch", text)