chore(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0

[dependabot]

Bumps actions/create-github-app-token from 3.2.0 to 3.3.0.

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

Commits

• 64ab729 chore(main): release 3.3.0 (#402)
• f3a828e ci: create signed dist commits in release workflow (#404)
• 655017f docs: clarify when owner grants access to all repositories (#378)
• 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
• a47236f feat: update permission inputs (#399)
• a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
• d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
• 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
• e85f677 test: omit stack traces from snapshots (#401)
• 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
• Additional commits viewable in compare view

[github-code-quality]

Code coverage overview

Languages: Go

Go / code-coverage/test

main 001dc6d	dependabot/github_ac... 10e370a	+/-
50%	50%	0%

Go / code-coverage/go

main 001dc6d	dependabot/github_ac... 10e370a	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 19, 2026 10:53 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

The failed updater-boundary regression still required the v3.2.0 token-action SHA after this PR moved the workflow to v3.3.0. I reproduced that failure, updated only the guard's exact expected SHA, and reran its source, delayed-token, repository-scope, signing, draft, exact-path and failure controls successfully. The assertions and permission values remain intact.

Upstream review covers 3.2.0 → 3.3.0, the only release in this range: release notes, changelog, and source comparison.

• New code-quality, organization-agent-settings and external-properties permission inputs, the seat-management description update, and removed team-discussions input: not applicable; the affected workflows use none of those inputs. No new permission is requested.
• Production dependency updates, including nested Undici 6.24.0 → 6.29.0, Octokit auth-app and p-retry: adopted by the action update; no local workaround was found to remove.
• README clarification about explicit owner plus an empty repository list: existing scoped calls and the repository-only updater assertion remain unchanged. The MIT license and Node >=24.4.0 requirement are unchanged. No separate minor-version migration guide is published.

The repair includes the current base through a signed merge. It will stay a draft until the new head's hosted checks and semantic review finish. The local fixture evaluates the updater's admission and generated-PR behavior with synthetic credentials; it does not claim a live credentialed updater execution.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T11:16:54.593142Z	10e370a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 10e370a26b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at head 10e370a26b0fccdfc9a21fb3cc5662276e2782de:

• Tested: all 28 hosted checks pass at this head (2 skipped by design), including the updater-boundary regression that pins the v3.3.0 token-action digest. Zero review threads, no conflicts.
• Reviewed: Codex reviewed this exact commit with no findings. The upstream release review for 3.2.0 → 3.3.0 is recorded above; none of the new inputs are used and no permission changes.
• Evaluated as a user: the change only moves the pinned token action used by the organization's scheduled and on-promotion workflows, which do not run on a pull request. The local updater fixture exercises the admission and generated-PR path with synthetic credentials. The live check is post-merge: the next Enable Auto-Merge and Refresh gh digests runs on main must mint their token and succeed.

Promoting and merging at this head.

[devantler]

🤖 Generated by the Agentic Engineer

Post-merge check: on main at the merge commit 0cb40d6e, the Release and Apply workflow execution policies runs, both of which mint their token with the updated action, completed successfully.

[devantler]

🤖 Generated by the Agentic Engineer

Independent post-merge acceptance at 0cb40d6ef4b25e39a846fcebeb7d1537504ca0b4: main CI run 39254249191, attempt 1, completed with 194 successful and 51 skipped jobs. All 245 job IDs are unique and match this run, attempt and revision; the required aggregate and all three queue-slot tests succeeded.

The actual job-step records also confirm token creation, use and cleanup succeeded in Release and Apply workflow execution policies, corroborating the earlier receipt.

The remaining live-path acceptance is still UNVERIFIED: Enable Auto-Merge run 39255056510 succeeded only through its ineligible-event path; its token-using job was skipped. The latest digest-refresh run, 39200036910, predates this merge. Collect the next eligible auto-merge execution and a digest-refresh execution whose token step actually runs; a successful skipped path does not satisfy either criterion. No workflow was dispatched or retried here. Source and merge credit remain with the delivering writer.

[devantler]

🤖 Generated by the Agentic Engineer

The remaining digest acceptance needs a real manifest change, not just another successful workflow run. At merged revision 0cb40d6ef4b25e39a846fcebeb7d1537504ca0b4, refresh-gh-digests.yaml generates the token and opens its draft only when preparation reports changed=true. The declared installer version is still 2.90.0, its four platform digests are present, and the preparation script, manifest and three version declarations did not change after the morning digest run. A manual dispatch does not force that condition; no dispatch or source change was made to manufacture it.

For the next collection, require successful token creation, use and cleanup after preparation actually changes the manifest. A no-change success leaves this path unverified. Preserve the existing reviewed digests and wait for a legitimate generated update.

The newer auto-merge run 39259187423 also completed only its ineligible-event path; its auto-merge job was skipped. Both outstanding live paths therefore remain UNVERIFIED. The previously verified Release and workflow-policy token paths remain valid evidence.