f96b2da199
Replace the cozystack-bot personal access token (GH_PAT) with a GitHub App (cozystack-ci) installation token across all CI/CD workflows. This improves security by using short-lived, scoped tokens instead of a long-lived PAT tied to a user account. Changes: - tags.yaml: use app token in all 3 jobs (prepare-release, generate-changelog, update-website-docs) - auto-release.yaml: use app token for daily patch releases - pull-requests-release.yaml: use app token for release finalization The cozystack-ci GitHub App (ID: 3297617) is installed org-wide with contents:write and pull-requests:write permissions. Secrets COZYSTACK_CI_APP_ID and COZYSTACK_CI_PRIVATE_KEY are set at org level. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| CODEOWNERS | ||
| PULL_REQUEST_TEMPLATE.md | ||