ci: use GitHub App token for release-please (#5)

* ci: trigger checks on release-please branches

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: add fluxopt git dep to dev group

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ci: use GitHub App token for release-please

GITHUB_TOKEN pushes don't trigger workflow events, so CI never runs on
release-please PRs. Use a GitHub App token instead, which does trigger
events and avoids PAT downsides (personal attribution, manual rotation).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: FBumann

.github/workflows/release.yaml

@@ -16,11 +16,18 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
+      - uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - uses: googleapis/release-please-action@v4
         id: release
         with:
           config-file: .release-please-config.json
           manifest-file: .release-please-manifest.json
+          token: ${{ steps.app-token.outputs.token }}
 
   publish:
     name: Build & publish to PyPI

pyproject.toml

@@ -44,6 +44,7 @@ include = ["src/fluxopt_plot/", "LICENSE", "README.md"]
 
 [dependency-groups]
 dev = [
+    "fluxopt @ git+https://github.com/FBumann/fluxopt.git",
     "mypy==1.19.1",
     "pre-commit==4.5.1",
     "pytest==9.0.2",