Automated changelog bumps on main are broken #1796

We have a clever github action publish which runs when we merge to main. It'll ensure that changelogs have an accurate release date on the latest release, and commit and push any changes made.

This clever action fails when it runs on main because main is a protected branch and the commit is rejected on push.

At the moment the github action uses a username and password saved as secret variables on the repo. I wonder if we should be using an app or service account instead - and then graning that service account permission to commit directly to main