…1410)

Bumps the all group with 1 update: [gcsfs](https://github.com/fsspec/gcsfs).


Updates `gcsfs` from 2026.4.0 to 2026.5.0
- [Release notes](https://github.com/fsspec/gcsfs/releases)
- [Commits](fsspec/gcsfs@2026.4.0...2026.5.0)

---
updated-dependencies:
- dependency-name: gcsfs
  dependency-version: 2026.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the all group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `7.1.0` | `7.2.0` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` |
| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `6.0.0` | `6.1.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.5` | `4.36.0` |


Updates `docker/build-push-action` from 7.1.0 to 7.2.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@bcafcac...f9f3042)

Updates `codecov/codecov-action` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@57e3a13...e79a696)

Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@4d04d5d...d7f5e7f)

Updates `docker/login-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@4907a6d...650006c)

Updates `docker/metadata-action` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@030e881...80c7e94)

Updates `github/codeql-action` from 4.35.5 to 4.36.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@9e0d7b8...7211b7c)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: docker/login-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: docker/metadata-action
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github/codeql-action
  dependency-version: 4.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…LEASE_BOT app token (#1407)

* fix: author release-please releases with a GitHub App token

Releases created by release-please using the default GITHUB_TOKEN are
authored by github-actions[bot]. GitHub deliberately does not trigger new
workflow runs from events caused by the default GITHUB_TOKEN (anti-recursion),
so the `release: published` event never fired for bot-created releases. As a
result the build / upload_pypi jobs (gated on `github.event_name == 'release'`)
and the deploy.yml workflow were skipped, and 2.0.3 was never published to PyPI
nor deployed.

Mint a short-lived GitHub App installation token in the release-please job and
pass it to the action so the release is authored by the App. Events from an App
token DO create new workflow runs, so the existing publish + deploy workflows
cascade automatically — no rewrite of build/upload/deploy needed.

Requires repo/org secrets RELEASE_APP_ID and RELEASE_APP_KEY (see #1406);
inert until those exist.

Refs #1406

Co-Authored-By: Claude Opus 4.8 <[email protected]>

* fix: scope release-please app token to least privilege

Set explicit permission-contents/permission-pull-requests on the
create-github-app-token step so the minted token does not inherit the App
installation's blanket permissions (zizmor: dangerous use of GitHub App tokens).
release-please only needs Contents (tags/releases) and Pull requests (release PR).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

* fix: use existing DS_RELEASE_BOT org app secrets for release-please

developmentseed already has an org-level GitHub App for release automation
(secrets DS_RELEASE_BOT_ID / DS_RELEASE_BOT_PRIVATE_KEY). Use those instead of
provisioning a new App, so no new secrets are needed and the workflow is no
longer blocked.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

---------

Co-authored-by: Claude Opus 4.8 <[email protected]>

…ics (#1414)

* chore: release 2.0.4

* fix: chart version

---------

Co-authored-by: ds-release-bot[bot] <116609932+ds-release-bot[bot]@users.noreply.github.com>
Co-authored-by: vincentsarago <[email protected]>