github-action: run GitHub tag/release events

[v1v]

What

Use service machine to support GitHub events, github-bot does not support GitHub events when creating Tags, PRs or Issues, therefore GitHuba actions will not run if they are caused by the above-mentioned user.

In addition, I enabled what @trentm mentioned in #228 (comment)

[trentm]

The GH API to create a release (https://docs.github.com/en/rest/releases/releases?apiVersion=2022-11-28#create-a-release) says it needs:

The token must have at least one of the following permission sets:

contents:write
contents:write and workflows:write

I guess this is bypassing using the GH token for this job and instead is using the CREATE_TAG_TOKEN secret that is manually maintained for this repo?

[v1v]

is using the CREATE_TAG_TOKEN secret that is manually maintained for this repo?

Correct. Unfortunately, we cannot use the ephemeral GH token if GitHub events are required.

In this particular the GitHub event is needed, to be able to run the release.yml workflow.

GitHub does not support GitHub events when the actor is the GitHub bot, a way to prevent recursivity

[v1v]

https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow

When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN, with the exception of workflow_dispatch and repository_dispatch, will not create a new workflow run