Use app-generated access token

Author: ralfhandl

.github/workflows/respec.yaml

@@ -22,6 +22,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+    - name: Generate access token
+      id: generate-token
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ secrets.OAI_SPEC_PUBLISHER_APPID }}
+        private-key: ${{ secrets.OAI_SPEC_PUBLISHER_PRIVATE_KEY }}
+        owner: OAI
+        repositories: OpenAPI-Specification
+    
     - uses: actions/checkout@v4 # checkout main branch
       with:
         fetch-depth: 0
@@ -35,8 +44,8 @@ jobs:
 
     - uses: actions/checkout@v4 # checkout gh-pages branch
       with:
-        token: ${{ secrets.OAS_REPO_TOKEN }}
-        repository: OAI/OpenAPI-Specification  # TODO: change to OAI/...
+        token: ${{ steps.generate-token.outputs.token }}
+        repository: OAI/OpenAPI-Specification
         ref: gh-pages
         path: deploy
 
@@ -46,16 +55,14 @@ jobs:
     - name: Create Pull Request
       uses: peter-evans/create-pull-request@v7
       with:
-        # A personal access token is required to push changes to the repository.
-        # This token needs to be refreshed regularly and stored in the repository secrets.
-        token: ${{ secrets.OAS_REPO_TOKEN }}
+        token: ${{ steps.generate-token.outputs.token }}
         branch: update-overlay-respec-version
         base: gh-pages
         delete-branch: true
         path: deploy
         labels: Housekeeping
         team-reviewers: OAI/tsc
-        title: Update ReSpec-rendered specification versions for Overlay
+        title: Overlay - Update ReSpec-rendered specification versions
         commit-message: Update ReSpec-rendered specification versions
         signoff: true
         body: |