chore: use github app token for beachball release

[Elizabeth Craig (ecraig12345)]

As a temporary measure until #36626 is ready, apply only the changes to release with the office-ogx-auth-helper GitHub app's token. There's a temporary template .devops/templates/run-with-token.yml which handles getting and revoking the token, and takes steps to run inside as a parameter.

To validate that creating the token works, I ran the pipeline against this branch. All branch rules have been updated to allow the app to bypass.

Also update scripts/beachball/src/customRenderers.ts and update-release-notes to use new token variables, and to cache the fetched PRs by commit, which should make the release process faster.

[github-actions]

📊 Bundle size report

✅ No changes found

[github-actions]

Pull request demo site: URL

[Copilot]

Pull request overview

Migrates release pipelines from a PAT to a temporary GitHub App token and optimizes release-note PR lookups.

Changes:

• Adds token creation/revocation around publishing.
• Adopts Beachball v3 token variables.
• Adds commit-based PR caching, though the Beachball renderer cache currently uses object identity.

Merge confidence: 68/100 — token permissions and renderer caching require correction.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.devops/templates/run-with-token.yml	Creates and revokes the app token.
.devops/templates/tools.yml	Configures the app’s Git identity.
.vscode/launch.json	Supplies the release-note token via environment.
azure-pipelines.release.yml	Updates v8 publishing and release notes.
azure-pipelines.release.web-components.yml	Updates Web Components publishing.
azure-pipelines.release.tools.yml	Updates tools publishing.
azure-pipelines.release.tools-experimental.yml	Renames the npm token variable.
azure-pipelines.release.headless.yml	Updates headless publishing.
azure-pipelines.release-headless-experimental.yml	Renames the npm token variable.
azure-pipelines.release-vnext.yml	Updates v9 publishing.
azure-pipelines.release-vnext-experimental.yml	Renames the npm token variable.
azure-pipelines.release-vnext-nightly.yml	Renames the npm token variable.
scripts/beachball/src/customRenderers.ts	Uses the app token and adds PR caching.
scripts/beachball/src/shared.config.ts	Updates Beachball token documentation.
scripts/update-release-notes/src/init.ts	Reads GitHub authentication from TOKEN.
scripts/update-release-notes/src/pullRequests.ts	Caches PR results by commit.

Suppressed comments (1)

scripts/beachball/src/customRenderers.ts:14

• This variable now contains a GitHub App installation token, not a personal access token. Keeping the githubPAT name makes the authentication source misleading; rename it to githubToken (including its warning check and Octokit initialization).

const githubPAT = process.env.BEACHBALL_GIT_TOKEN;
if (!githubPAT && (process.argv.includes('bump') || process.argv.includes('publish'))) {
  console.warn('\nBEACHBALL_GIT_TOKEN environment variable not found. GitHub requests may be rate-limited.\n');
}

const github = new Octokit({
  ...fluentRepoDetails,
  ...(githubPAT && { auth: 'token ' + githubPAT }),

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.