ci: fix publish release workflow

.github/workflows/build.yml

@@ -10,11 +10,8 @@ on:  # https://docs.github.com/en/actions/reference/workflows-and-actions/events
     # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule
     - cron: '0 15 1 * *'
   push:
-    branches:
+    branches: ['**']  # build all branches
-    - main
+    tags-ignore: ['**'] # don't build tags
-    - release
-    tags-ignore:  # don't build tags
-    - '**'
     paths-ignore:
     - '**/*.md'
     - '.act*'
@@ -57,7 +54,8 @@ jobs:
   build:
   ###########################################################
 
-    if: github.event_name != 'push' || github.ref == 'refs/heads/main'
+    # Run on push for all branches; on pull_request only for forked PRs to avoid duplicate builds for same-repo branches
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
 
     permissions:
       packages: write

.github/workflows/publish-release.yml

@@ -37,18 +37,27 @@ jobs:
       run: env | sort
 
 
+    - name: Generate GitHub Access Token
+      uses: tibdex/github-app-token@v2  # https://github.com/tibdex/github-app-token
+      id: generate_token
+      # see https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#authenticating-with-github-app-generated-tokens
+      with:
+        # see https://github.com/organizations/Second-Hand-Friends/settings/apps/kleinanzeigen-bot-tu
+        app_id: ${{ secrets.DEPS_UPDATER_APP_ID }}
+        private_key: ${{ secrets.DEPS_UPDATER_PRIVATE_KEY }}
+
+
     - name: Git Checkout
       uses: actions/checkout@v5  # https://github.com/actions/checkout
       with:
+        token: ${{ steps.generate_token.outputs.token }}
         ref: main
+        fetch-depth: 0
 
 
     - name: Push main to release branch
       run: |
         set -eux
 
-        git config user.name "github-actions[bot]"
-        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
         # Push current main state to release branch to trigger release creation
         git push origin HEAD:release