ci(release): support bypass rules when creating tag releases

Author: v1v

.github/workflows/release-step-3.yml

@@ -208,8 +208,6 @@ jobs:
       - publish-aws-lambda
     runs-on: ubuntu-latest
     if: ${{ ! inputs.dry_run }}
-    permissions:
-      contents: write
     steps:
       - uses: actions/checkout@v5
         with:
@@ -223,9 +221,21 @@ jobs:
             echo "Release notes not published yet. Sleeping 30 seconds, retrying afterwards"
             sleep 30s
           done
+
+      - name: Get token
+        id: get_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OBS_AUTOMATION_APP_ID }}
+          private-key: ${{ secrets.OBS_AUTOMATION_APP_PEM }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            apm-agent-java
+          permission-contents: write
+
       - name: Create GitHub Release
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.get_token.outputs.token }}
         run: |
           gh release create ${{ env.RELEASE_VERSION_TAG }} \
             --title="Release ${{ env.RELEASE_VERSION }}" \