fetch_files only works on public repositories

From @jochen :

The repo needs to be public, otherwise fetch_files does not work.

Maybe PRIVATE_TOKEN could be used there as well, so that the release workflow can be run on private repos.