fix: re-mint GitHub App token before goreleaser to avoid mid-run expiry

[Erik Osterman (Cloud Posse) (osterman)]

what

• In shared-go-auto-release.yml's goreleaser job, mint a second, fresh
  GitHub App installation token immediately before the "Run GoReleaser" step
  (after all the setup/GPG-import/disk-cleanup steps), instead of reusing the
  single token minted at the very start of the job.
• Use that fresh token for both the GoReleaser invocation itself and the
  immediately-following "Attest build provenance" step.

why

• GitHub App installation tokens are hard-capped at 1 hour and cannot be
  extended or refreshed — that's a GitHub API limit, not something
  configurable in this workflow.
• The job mints its token once at the very start, then hands it straight to a
  goreleaser release --timeout 180m invocation. GoReleaser's own reported
  build+sign+SBOM+publish runtime for atmos has been climbing on recent
  runs — 44m14s -> 53m14s -> 1h5m52s — and is now routinely exceeding that
  1-hour token ceiling.
• When the token expires mid-run, GoReleaser's final publish-phase API call
  (listing/deleting existing draft releases before creating the new one)
  fails with a 401 Bad credentials, e.g.:

  ⨯ release failed after 1h5m52s error=scm releases: failed to publish
  artifacts: could not delete existing drafts: could not list existing
  drafts: GET https://api.github.com/repos/cloudposse/atmos/releases?per_page=50:
  401 Bad credentials []
  

  This looks like a credentials/permissions problem but is really just an
  expired token — confirmed by cross-referencing actions/create-github-app-token's
  documented 1-hour installation-token TTL against goreleaser's own
  self-reported elapsed time in the failing runs.
• Re-minting right before the long-running step maximizes the runway the
  token has before goreleaser needs it, without touching goreleaser's own
  build/sign/SBOM/publish logic at all.

references

• Observed failing on cloudposse/atmos PR #2926 (labeled release/feature,
  which triggers this shared workflow via feature-release.yml on every
  push): https://github.com/cloudposse/atmos/actions/runs/33914587913/job/101158920515
• GoReleaser only accepts a static bearer token (GITHUB_TOKEN env var or a
  token file) — it has no native GitHub App auth or internal token-refresh,
  so the fix has to live on the workflow side:
  https://goreleaser.com/scm/github/
• GitHub App installation token lifetime (1 hour, non-configurable):
  https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation

[mergify]

Important

Cloud Posse Engineering Team Review Required

This pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes.

To expedite this process, reach out to us on Slack in the #pr-reviews channel.