[devsy-app]

Summary

Replaces the deprecated app-id input of actions/create-github-app-token@v3 (pinned at bcd2ba49, v3.1.0) with the supported client-id input across the four remaining workflows: act.yml, cla.yml, pr-ci.yml, and release.yml.

Problem

actions/create-github-app-token@v3 deprecated the app-id input in favor of client-id. The deprecated input emits a deprecation warning in CI runs and will eventually be removed. Five workflows in this repo use the action; workflow-approval.yml already migrated to client-id, leaving the other four emitting the deprecation warning on every run that creates an app token.

Inspected runs

• Push run ci: cap e2e jobs with timeout-minutes (#991) — Pull Request workflow, run id 31531277926, conclusion success, 11m53s (2026-08-12).
• Push run ci: cap e2e jobs with timeout-minutes (#991) — Desktop CI, run id 31531277934, conclusion success, 21s (2026-08-11).

Both invoke actions/create-github-app-token with app-id, triggering the deprecation warning.

Change

Four single-line edits (app-id → client-id), one per workflow, each in the with: block of the create-github-app-token step:

File	Change
.github/workflows/act.yml	app-id → client-id
.github/workflows/cla.yml	app-id → client-id
.github/workflows/pr-ci.yml	app-id → client-id
.github/workflows/release.yml	app-id → client-id

No other lines touched. Total diff: +4/-4.

Why this is safe

• client-id and app-id are interchangeable per the action's docs: client-id takes precedence and app-id is now a fallback. The value (${{ secrets.DEVSY_GITHUB_APP_ID }}) is unchanged — the same secret is used for both inputs, since the App ID resolves identically either way.
• workflow-approval.yml already uses client-id with the same secret, proving the configuration works in production.
• After this change, all five workflows consistently use client-id; no app-id: inputs remain (grep -rn "app-id:" .github/workflows/*.yml returns nothing).

Validation

• Re-read each edited file end-to-end around the changed line to confirm correct indentation and context.
• YAML parse: python3 -c "import yaml; yaml.safe_load(open('<file>'))" → YAML OK for all four files.
• task cli:format → exit 0 (no Go files touched; formatting gate clean).
• task cli:lint:ci → 0 issues.
• task cli:test → passes except the known pre-existing pkg/git TestRepoClone* failures (stale --config filter.lfs.* assertions when git-lfs is absent), unrelated to this change and failing on origin/main already.
• act/docker unavailable in this environment, so act --list validation was skipped; validated via YAML parse instead.

This PR was created by an AI agent as part of an automated daily CI optimization job.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	27b3f5c
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a7c3ffe749f6400089b6aff

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	27b3f5c
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a7c3ffe6f2361000809c1b9

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}