build(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0

[dependabot]

Bumps actions/create-github-app-token from 3.2.0 to 3.3.0.

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

Commits

• 64ab729 chore(main): release 3.3.0 (#402)
• f3a828e ci: create signed dist commits in release workflow (#404)
• 655017f docs: clarify when owner grants access to all repositories (#378)
• 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
• a47236f feat: update permission inputs (#399)
• a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
• d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
• 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
• e85f677 test: omit stack traces from snapshots (#401)
• 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates both ClawSweeper token-creation steps from actions/create-github-app-token v3.2.0 to the pinned v3.3.0 commit.

Example: An issue event triggers the ClawSweeper dispatch workflow.

• Before: The dispatch token is created using actions/create-github-app-token v3.2.0.
• After: The same repository-scoped token request uses v3.3.0.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused maintenance patch with verified upstream compatibility and no identified defect; direct execution evidence for the upgraded action is limited.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot maintenance PR is outside the ordinary contributor-proof gate; available checks do not establish execution of the upgraded action, and token targets, permissions, consumers, and revocation settings are unchanged.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The existing review-dispatch automation uses an older token action and its bundled dependencies.
Reason: The update adopts the upstream minor release without adding settings or changing the workflow's intended behavior.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: main still uses v3.2.0, and this focused dependency update has no identified correctness or security defect.

Priority: P3
Reviewed head: 7d2af2528ea1103fd836809ed8b03f90069e0b12

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: No supplied execution demonstrates both token-creation steps using the upgraded pin; the ordinary contributor-proof gate does not apply to this bot-authored maintenance PR.

Agent review details

How this fits together

GitHub issue, pull request, and comment events enter a workflow that creates scoped GitHub App tokens and sends review requests or comment acknowledgments.

flowchart LR
  A[GitHub events] --> B[Dispatch workflow]
  B --> C[Create GitHub App tokens]
  C --> D[ClawSweeper dispatch]
  C --> E[Comment acknowledgments]

Loading

Technical review

Best possible solution:

Land the focused, SHA-pinned dependency update through the normal dependency maintenance process.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported runtime bug; the old and proposed pins are directly verified in source.

Is this the best way to solve the issue?

Updating both uses together while retaining immutable commit pins is an appropriately narrow maintenance change.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against 0b0b979b3cd6.

Provenance checked

• ClawSweeper token-creation action pins keeps the original intent (4b98dfc: The recorded commit adds the ClawSweeper dispatch workflow; its repository-specific token permissions and dispatch behavior are retained.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Pinned PR scope: The introduced diff changes only two action commit pins; repository targets, permission inputs, conditions, and downstream commands are unchanged. (.github/workflows/clawsweeper-dispatch.yml:34, 7d2af2528ea1)
• Default branch still needs the update: GitHub confirms main remains at the pinned base revision, whose two token steps use v3.2.0; the PR is open and unmerged. (.github/workflows/clawsweeper-dispatch.yml:34, 0b0b979b3cd6)
• Executed dependency contract: The workflow executes this action with an App private key. The verified v3.3.0 release targets the proposed SHA, retains node24 and every input used here, and updates permission metadata and bundled dependencies. Token scoping, masking, and post-job revocation remain in the action's unchanged source owners. (action.yml, 64ab729a6294)
• Workflow provenance and routing: The changed base lines trace to the ClawSweeper dispatch workflow commit authored and committed by steipete. Its stated purpose is adding that workflow; the dependency bump preserves its design. Earlier follow-history traversal encountered an unavailable local object, so no broader ownership or introduction claim is made. (.github/workflows/clawsweeper-dispatch.yml:34, 4b98dfc5f0d3)
• Discussion and validation: The fetched comments contain review-status messages and no maintainer direction or behavioral proof. Exact-head checks report eight successes and one neutral result, with no failures. (7d2af2528ea1)
• Repository review policy: The complete root AGENTS.md requests the shared review helper; the explicit single-reviewer instruction takes precedence, so no helper or second reviewer ran. No nested AGENTS.md or maintainer-notes directory was found for the changed workflow. (AGENTS.md:3, 7d2af2528ea1)

Likely related people:

• Peter Steinberger: Raw commit 4b98dfc adds .github/workflows/clawsweeper-dispatch.yml:35 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 4b98dfc5f0d3; files: .github/workflows/clawsweeper-dispatch.yml)

Labels

Label changes:

• add P3: Routine minor dependency maintenance with unchanged workflow inputs and no demonstrated urgent user-facing failure.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine minor dependency maintenance with unchanged workflow inputs and no demonstrated urgent user-facing failure.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 15, 2026, 2:57 PM ET / 18:57 UTC.

[steipete]

Included actions/create-github-app-token 3.3.0 in #252, now merged. The consolidated update passed the full make check gate, including govulncheck, 85.1% coverage, six-platform snapshot builds, and exact-head Linux/macOS/Windows/Docker CI. Closing this superseded dependency PR. Thanks!

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.