CI checks are not triggered by create-release-candidate action

[gmaclennan]

When creating a PR via the new create-release-candidate action, CI checks do not run. According to Github docs:

When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs. For example, if a workflow run pushes code using the repository's GITHUB_TOKEN, a new workflow will not run even when the repository contains a workflow configured to run when push events occur.

Checks will run for any commits added to the release branch, just not for the initial PR.

A short-term manual workaround for this is to make the PR a draft, then mark it "ready to review". This triggers the ready_for_review activity type, which is a trigger for our CI checks workflow. I just did this for the release candidate PR

An automated workaround is to create a personal access token (PAT) from our bot account digidem, with restricted permissions for creating pull requests, and use this as the token for the API request. Some more details about this problem and other solutions is documented here.

This is not an issue for the optic release automation that we use because that action is linked to a Github App, and apps have elevated permissions that allows PRs to trigger workflow runs.