fix: use Hyper Gonk GitHub App for CI permissions

.github/workflows/combine.yml

@@ -11,12 +11,18 @@ jobs:
   combine:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.HYPER_GONK_APP_ID }}
+          private-key: ${{ secrets.HYPER_GONK_PRIVATE_KEY }}
+
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.head_ref || 'main' }}
-          # This action secret contains a fine-grained personal access token with permissions to read/write repo content
-          # It is necessary because the default GITHUB_TOKEN cannot re-trigger workflows after pushing
-          token: ${{ secrets.COMBINE_CI_TOKEN || secrets.GITHUB_TOKEN }}
+          # Use Hyper Gonk token to allow CI to trigger on commits pushed by this workflow
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: yarn-install
         uses: ./.github/actions/yarn-install-with-cache

.github/workflows/release.yml

@@ -29,6 +29,13 @@ jobs:
       - name: Install Dependencies
         run: yarn install --no-immutable
 
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.HYPER_GONK_APP_ID }}
+          private-key: ${{ secrets.HYPER_GONK_PRIVATE_KEY }}
+
       - name: Create Release PR or Publish to NPM
         id: changesets
         uses: changesets/action@v1
@@ -37,5 +44,5 @@ jobs:
           publish: yarn release
         env:
           NPM_CONFIG_PROVENANCE: true
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/update-hyperlane-deps.yml

@@ -14,10 +14,18 @@ jobs:
       pull-requests: write
 
     steps:
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.HYPER_GONK_APP_ID }}
+          private-key: ${{ secrets.HYPER_GONK_PRIVATE_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           ref: main
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Configure Git
         run: |
@@ -73,7 +81,7 @@ jobs:
       - name: Check for changes and create PR
         if: always()
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
         run: |
           if ! git diff --quiet; then
             git checkout -b ci/update-hl-deps