From 39dcc0a7ba9c90606a51c68770d93339800f1d0d Mon Sep 17 00:00:00 2001
From: Cassondra Roberts <1840295+castastrophe@users.noreply.github.com>
Date: Fri, 6 Nov 2026 21:06:57 +0000
Subject: [PATCH 1/3] ci: open Weaver sync PRs with the GitHub App

Sync templates with the org GitHub App token instead of PAT_GITHUB.
---
 .github/workflows/sync.yaml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sync.yaml b/.github/workflows/sync.yaml
index ebdbf96..65010bd 100644
--- a/.github/workflows/sync.yaml
+++ b/.github/workflows/sync.yaml
@@ -9,11 +9,23 @@ jobs:
     sync:
         runs-on: ubuntu-latest
         steps:
+            - name: Create GitHub App token
+              id: app-token
+              uses: actions/create-github-app-token@v3
+              with:
+                  app-id: ${{ secrets.APP_ID }}
+                  private-key: ${{ secrets.APP_PRIVATE_KEY }}
+                  owner: ${{ github.repository_owner }}
+                  permission-contents: write
+                  permission-pull-requests: write
+
             - uses: actions/checkout@v7
+              with:
+                  token: ${{ steps.app-token.outputs.token }}
             - id: weaver
               uses: allonsy-studio/actions-weaver@v4
               with:
-                  token: ${{ secrets.PAT_GITHUB }}
+                  token: ${{ steps.app-token.outputs.token }}
                   templates: templates
                   variables: '{"npm_org": "@allons-y"}'
             - run: echo '${{ steps.weaver.outputs.pull-requests }}'

From 61ad63a5804851ac2109a277f31fc013c5ae8c71 Mon Sep 17 00:00:00 2001
From: Cassondra Roberts <1840295+castastrophe@users.noreply.github.com>
Date: Fri, 6 Nov 2026 21:39:00 +0000
Subject: [PATCH 2/3] fix: use client-id for the GitHub App token

The app-id input of actions/create-github-app-token is deprecated. Use the public client ID instead.
---
 .github/workflows/sync.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sync.yaml b/.github/workflows/sync.yaml
index 65010bd..ed3f291 100644
--- a/.github/workflows/sync.yaml
+++ b/.github/workflows/sync.yaml
@@ -13,7 +13,7 @@ jobs:
               id: app-token
               uses: actions/create-github-app-token@v3
               with:
-                  app-id: ${{ secrets.APP_ID }}
+                  client-id: Iv23likZlf3zuizX5I5l
                   private-key: ${{ secrets.APP_PRIVATE_KEY }}
                   owner: ${{ github.repository_owner }}
                   permission-contents: write

From a5e1c01362a34677589027d95adeebee9647eefd Mon Sep 17 00:00:00 2001
From: Cassondra Roberts <1840295+castastrophe@users.noreply.github.com>
Date: Fri, 6 Nov 2026 21:46:51 +0000
Subject: [PATCH 3/3] fix: read the GitHub App client ID from
 secrets.APP_CLIENT_ID

Keep the client ID alongside the private key as an org secret instead of inline.
---
 .github/workflows/sync.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sync.yaml b/.github/workflows/sync.yaml
index ed3f291..5288218 100644
--- a/.github/workflows/sync.yaml
+++ b/.github/workflows/sync.yaml
@@ -13,7 +13,7 @@ jobs:
               id: app-token
               uses: actions/create-github-app-token@v3
               with:
-                  client-id: Iv23likZlf3zuizX5I5l
+                  client-id: ${{ secrets.APP_CLIENT_ID }}
                   private-key: ${{ secrets.APP_PRIVATE_KEY }}
                   owner: ${{ github.repository_owner }}
                   permission-contents: write