From 51fbf75c3f020433c0e4b1506f78e588786b1074 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Fri, 10 Jul 2026 12:25:59 -0400
Subject: [PATCH] ci: use GitHub App token to open upstream-ledger-sync PR
 (#165)

The built-in GITHUB_TOKEN cannot open the sync PR: the enterprise policy
blocks GitHub Actions from creating/approving pull requests, which
overrides the org and repo settings. That restriction applies only to
github-actions[bot], so mint a PROMOTE_APP installation token and pass
it to create-pull-request, mirroring promote-to-main.yml.
---
 .github/workflows/upstream-ledger-sync.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/upstream-ledger-sync.yml b/.github/workflows/upstream-ledger-sync.yml
index 837c74db..fc44f09e 100644
--- a/.github/workflows/upstream-ledger-sync.yml
+++ b/.github/workflows/upstream-ledger-sync.yml
@@ -33,9 +33,22 @@ jobs:
       - name: Sync ledger
         run: python3 scripts/triage.py sync
 
+      # The built-in GITHUB_TOKEN cannot open PRs: the enterprise policy blocks
+      # "GitHub Actions creating/approving pull requests" and overrides org+repo.
+      # That restriction applies only to github-actions[bot], so we mint a GitHub
+      # App installation token instead. PROMOTE_APP must carry pull-requests:write
+      # + contents:write on this repo.
+      - name: Mint app token for the bot PR
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.PROMOTE_APP_ID }}
+          private-key: ${{ secrets.PROMOTE_APP_PRIVATE_KEY }}
+
       - name: Open/refresh PR if the ledger changed
         uses: peter-evans/create-pull-request@v7
         with:
+          token: ${{ steps.app-token.outputs.token }}
           base: dev
           branch: bot/upstream-ledger-sync
           commit-message: "chore: sync upstream triage ledger"