ci: publish to DroidDeck-CI with the org's CI app, not a personal token

DROIDDECK_CI_TOKEN never existed, so PR Release Publish skipped its
upload, and a personal token would expire and belong to one person. Both
workflows now mint a token of the org's DroidDeck CI Publisher app,
installed on DroidDeck-CI only with Contents: write (its ID in the
DROIDDECK_CI_APP_ID variable, its key in DROIDDECK_CI_APP_KEY). No
fallback: a main build without them fails its announce job.

.github/workflows/build.yml

@@ -438,9 +438,10 @@ jobs:
 
   # Each signed main build as a prerelease of the public Droid-Deck/DroidDeck-CI (main-<sha>, the
   # last KEEP kept), where anyone can download it without a GitHub account, then a post in the
-  # Discord's builds channel linking to it. DROIDDECK_CI_TOKEN (contents: write on DroidDeck-CI)
-  # and DISCORD_BUILDS_WEBHOOK (the channel's webhook URL) are each optional: without the token
-  # the post links to this run's artifacts, without the webhook nothing is posted.
+  # Discord's builds channel linking to it. The release is made with a token of the org's
+  # "DroidDeck CI Publisher" app (installed on DroidDeck-CI only, Contents: write): its ID in the
+  # DROIDDECK_CI_APP_ID variable, its private key in the DROIDDECK_CI_APP_KEY secret.
+  # DISCORD_BUILDS_WEBHOOK is the channel's webhook URL.
   announce:
     needs: [build, sign]
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
@@ -458,16 +459,20 @@ jobs:
           merge-multiple: true
           path: signed
 
+      - uses: actions/create-github-app-token@v2
+        id: ci-token
+        with:
+          app-id: ${{ vars.DROIDDECK_CI_APP_ID }}
+          private-key: ${{ secrets.DROIDDECK_CI_APP_KEY }}
+          owner: Droid-Deck
+          repositories: DroidDeck-CI
+
       - name: Publish to DroidDeck-CI
         id: publish
         env:
-          GH_TOKEN: ${{ secrets.DROIDDECK_CI_TOKEN }}
+          GH_TOKEN: ${{ steps.ci-token.outputs.token }}
         run: |
           set -euo pipefail
-          if [ -z "$GH_TOKEN" ]; then
-            echo "::warning::No DROIDDECK_CI_TOKEN secret; the post links to this run's artifacts instead"
-            exit 0
-          fi
           tag=main-${GITHUB_SHA::7}
           cat signed/SHA256SUMS-*.txt > signed/SHA256SUMS.txt
           rm signed/SHA256SUMS-*.txt
@@ -495,10 +500,8 @@ jobs:
         env:
           WEBHOOK: ${{ secrets.DISCORD_BUILDS_WEBHOOK }}
           GH_TOKEN: ${{ github.token }}
-          VARIANTS: ${{ needs.build.outputs.variants }}
           RELEASE: ${{ steps.publish.outputs.release }}
           APK: ${{ steps.publish.outputs.apk }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
           set -euo pipefail
           if [ -z "$WEBHOOK" ]; then
@@ -516,11 +519,7 @@ jobs:
           else
             what="[\`${GITHUB_SHA::7}\`]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/commit/$GITHUB_SHA): $subject"
           fi
-          if [ -n "$RELEASE" ]; then
-            get=$(printf 'Download: [standard APK](<%s>) · [all variants](<%s>)' "$APK" "$RELEASE")
-          else
-            get=$(printf 'APKs (%s, GitHub sign-in needed): <%s#artifacts>' "$(jq -r 'join(", ")' <<<"$VARIANTS")" "$RUN_URL")
-          fi
+          get=$(printf 'Download: [standard APK](<%s>) · [all variants](<%s>)' "$APK" "$RELEASE")
           content=$(printf '**New signed build** `main-%s`\n%s\n%s' "${GITHUB_SHA::7}" "$what" "$get")
           jq -n --arg content "$content" '{content: $content, allowed_mentions: {parse: []}}' |
             curl -fsS -H 'Content-Type: application/json' -d @- "$WEBHOOK" -o /dev/null

.github/workflows/pr-release-publish.yml

@@ -120,18 +120,22 @@ jobs:
         with:
           name: droiddeck-pr-signed-standard
           path: signed
-      - name: Publish to DroidDeck-CI when configured
+      # A token of the org's "DroidDeck CI Publisher" app, as build.yml's announce job uses.
+      - uses: actions/create-github-app-token@v2
+        id: ci-token
+        with:
+          app-id: ${{ vars.DROIDDECK_CI_APP_ID }}
+          private-key: ${{ secrets.DROIDDECK_CI_APP_KEY }}
+          owner: Droid-Deck
+          repositories: DroidDeck-CI
+      - name: Publish to DroidDeck-CI
         env:
-          GH_TOKEN: ${{ secrets.DROIDDECK_CI_TOKEN }}
+          GH_TOKEN: ${{ steps.ci-token.outputs.token }}
           PR_NUMBER: ${{ inputs.pr_number }}
           HEAD_SHA: ${{ needs.authorize.outputs.head_sha }}
           LABEL: ${{ needs.authorize.outputs.label }}
         run: |
           set -euo pipefail
-          if [[ -z "$GH_TOKEN" ]]; then
-            echo '::warning::No CI token; download the signed APK from this run'
-            exit 0
-          fi
           repo=Droid-Deck/DroidDeck-CI
           tag="pr-$PR_NUMBER"
           apk="DroidDeck-$LABEL.apk"