chore: use app token for semantic release

[sethc2]

No description provided.

[dryrunsecurity]

This pull request uses the third-party GitHub Action tibdex/github-app-token@v1 in .github/workflows/ci.yml, which poses a supply-chain risk because it’s pinned to a floating major tag rather than a specific commit SHA; pinning to a commit SHA is recommended to ensure the exact reviewed code runs. No specific vulnerability was found and the issue is non-blocking.

Third-Party Action Supply Chain Risk in .github/workflows/ci.yml

Vulnerability

Third-Party Action Supply Chain Risk

Description

The GitHub Actions workflow uses tibdex/github-app-token@v1. While no specific vulnerabilities were found in this action version, pinning to a major version tag (@v1) introduces a supply chain risk. This practice allows the action's maintainers to introduce new code, potentially malicious or vulnerable, into the workflow without explicit review or changes to the workflow file. The best practice for securely depending on third-party GitHub Actions is to pin them to a specific commit SHA, which ensures that the exact version of the code that was reviewed is always used.

apollo-federation-ruby/.github/workflows/ci.yml

Lines 100 to 103 in 162993f

	uses: tibdex/github-app-token@v1
	with:
	app_id: ${{ vars.TOKEN_APP_ID }}
	installation_id: ${{ vars.TOKEN_APP_INSTALLATION_ID }}

---

All finding details can be found in the DryRun Security Dashboard.