Update publish workflow to allow triggering release.published event

Author: frankie567

.github/workflows/sdk_publish.yaml

@@ -13,13 +13,16 @@ on:
       - RELEASES.md
       - '*/RELEASES.md'
 jobs:
-  mint-token:
+  tokens:
     runs-on: ubuntu-latest
     outputs:
-      api-token: ${{ steps.mint-token.outputs.api-token }}
+      pypi-token: ${{ steps.pypi-token.outputs.pypi-token }}
+      gh-token: ${{ steps.gh-token.outputs.token }}
     steps:
-      - name: Mint API token
-        id: mint-token
+      # Trusted Publisher PyPI token
+      # See: https://docs.pypi.org/trusted-publishers/using-a-publisher/)
+      - name: Mint PyPI token
+        id: pypi-token
         run: |
           # retrieve the ambient OIDC token
           resp=$(curl -sS --fail -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
@@ -31,11 +34,19 @@ jobs:
           api_token=$(jq -r '.token' <<< "${resp}")
 
           # see the next step in the workflow for an example of using this step output
-          echo "api-token=${api_token}" >> "${GITHUB_OUTPUT}"
+          echo "pypi-token=${api_token}" >> "${GITHUB_OUTPUT}"
+      # Generate a GitHub App Installation token to allow this workflow to trigger other events (like release published)
+      # See: https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/triggering-a-workflow#triggering-a-workflow-from-a-workflow
+      - name: Generate a GitHub App Installation token
+        id: gh-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.INTERNAL_GHA_APP_ID }}
+          private-key: ${{ secrets.INTERNAL_GHA_APP_PRIVATE_KEY }}
   publish:
-    needs: mint-token
+    needs: tokens
     uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15
     secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      pypi_token: ${{ needs.mint-token.outputs.api-token }}
+      github_access_token: ${{ needs.tokens.outputs.gh-token }}
+      pypi_token: ${{ needs.tokens.outputs.pypi-token }}
       speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}