ci: create verified release commits with the GitHub App

[DariuszPorowski]

Summary

The release workflow now creates the first commit on a new release branch (Update samples for vX.Y) through the GitHub Git database API with the radius-release App token. GitHub signs commits created this way, so the commit is Verified. The script confirms that verification before it creates or fast-forwards the release branch, and it still publishes the branch with a single ref update, so push-triggered workflows run once on it, as before.

Reason for change

release-samples.sh committed locally and ran git push. The App token authenticated the push, but nothing signed the commit: --signoff only adds the DCO trailer. GitHub reports the v0.60 release commit 01643e2 as unsigned.

A new vX.Y branch is only covered by the v[0-9].[0-9][0-9] ruleset, which doesn't require signatures; the edge ruleset's signature rule applies once the workflow makes the branch the default. The unsigned commit then appeared in the upmerge PR #2669, and that PR's commits were rewritten with a maintainer's signature before it merged.

GitHub signs commits that a GitHub App creates through the API when the request has no custom author, committer, or signature (Signature verification for bots). peter-evans/create-pull-request uses the same blobs, tree, and commit flow for sign-commits: true.

upmerge.yaml still creates local commits (Upmerge to edge, Preserve edge-specific configuration); this PR doesn't change it.

How to test

The workflow only runs on workflow_dispatch and changes the default branch, so it wasn't run end to end. Instead:

• Ran the script on Ubuntu 24.04 (bash 5.2, jq 1.7, GNU coreutils 9.4) against a stub gh that implements the blobs, trees, commits, and refs endpoints with git plumbing. All 43 checks passed, covering a new branch, fast-forwarding an existing branch, rejecting a diverged branch, not publishing an unverified commit, stopping on a tree mismatch, deletions, file modes, symlinks, paths with spaces, missing variables, no changes, and API failures. Six deliberate regressions to the script were each caught. The stub isn't part of this PR.
• actionlint, bash -n, and git diff --check pass. shellcheck reports only the existing SC2086 note on echo $VERSION_NUMBER.
• Checked the branch-existence probe (gh api .../git/ref/heads/<branch> --silent) against this repository: exit 0 for v0.60 and 1 for a missing branch.

On the next release, the first commit on the new vX.Y branch should show Verified, authored by radius-release[bot] and committed by GitHub. If GitHub doesn't verify it, the job fails before any branch is created.

File change summary

File	Summary of change
.github/scripts/release-samples.sh	Replaces the local git commit and git push with Git database API calls (blobs, tree, commit, then ref) using GH_TOKEN. Keeps the DCO sign-off in the message, checks that the remote tree matches the staged changes, fails before publishing if the commit isn't verified, and only fast-forwards an existing release branch, as git push did. Adds pipefail.
.github/workflows/release.yaml	Passes the App token and bot identity to the release step, removes the unused Configure git step, and stops persisting checkout credentials because the job no longer pushes with git.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None