From 3a1f052978e59ce671c8c38a9358f8501255db4f Mon Sep 17 00:00:00 2001
From: Peyton Lee <peyton.lee@alleninstitute.org>
Date: Fri, 18 Sep 2026 16:08:33 -0700
Subject: [PATCH] fix: Use built-in token for Git authentication

---
 .github/workflows/release-new-version.yml | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml
index 4502361..35fd090 100644
--- a/.github/workflows/release-new-version.yml
+++ b/.github/workflows/release-new-version.yml
@@ -28,21 +28,11 @@ jobs:
       contents: write # required to push new tag to repo
 
     steps:
-      # Create a token so it can be used during checkout + push steps; it must
-      # be explicitly passed to steps that need it.
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          permission-contents: write
-
       - name: Checkout the repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0 # fetch full commit and tag history
-          token: ${{ steps.app-token.outputs.token }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           persist-credentials: false
 
       - name: Setup Python
@@ -79,7 +69,7 @@ jobs:
           git push origin ${VERSION_TAG}
           git config --unset-all http.extraheader
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           VERSION_TAG: ${{ steps.get-tag.outputs.VERSION_TAG }}