fix(ci): use dependency update app

.github/workflows/update-powershell-dependencies.yml

@@ -62,8 +62,8 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          client-id: ${{ vars.ATLASSIANPS_RELEASE_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ATLASSIANPS_RELEASE_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.DEPENDENCY_UPDATE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.DEPENDENCY_UPDATE_APP_PRIVATE_KEY }}
           owner: AtlassianPS
           repositories: ${{ matrix.target.repository }}
           permission-contents: write

dependency-updates/README.md

@@ -10,21 +10,21 @@ The controller and workflow contract are validated by the repository's `CI` work
 
 ## GitHub App
 
-The workflow reuses the organization-wide AtlassianPS Release Bot instead of maintaining a second
-automation identity.
-Give the App access only to this controller and the repositories in `targets.json`.
+The workflow uses the dedicated AtlassianPS Dependency Updates App so routine dependency pull
+requests do not share the release identity.
+Give the App selected-repository access only to the repositories in `targets.json`.
 It needs these repository permissions:
 
 - Contents: read and write
 - Issues: read and write
 - Pull requests: read and write
 - Workflows: read and write
 
-Expose its Client ID as an organization variable and its private key as an organization secret,
-including access from this repository:
+Expose its Client ID as an Actions variable and its private key as an Actions secret in this
+repository:
 
-- `ATLASSIANPS_RELEASE_APP_CLIENT_ID`
-- `ATLASSIANPS_RELEASE_APP_PRIVATE_KEY`
+- `DEPENDENCY_UPDATE_APP_CLIENT_ID`
+- `DEPENDENCY_UPDATE_APP_PRIVATE_KEY`
 
 The workflow requests a short-lived token for one target repository at a time.
 

dependency-updates/Tests/ControllerConfiguration.Tests.ps1

@@ -0,0 +1,25 @@
+Describe 'Dependency update controller configuration' {
+    It 'uses only the dedicated dependency-update App credentials' {
+        $repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '../..')).ProviderPath
+        $controllerWorkflowPath = Join-Path $repositoryRoot '.github/workflows/update-powershell-dependencies.yml'
+        $workflow = Get-Content -LiteralPath $controllerWorkflowPath -Raw
+
+        $workflow | Should -Match 'vars\.DEPENDENCY_UPDATE_APP_CLIENT_ID'
+        $workflow | Should -Match 'secrets\.DEPENDENCY_UPDATE_APP_PRIVATE_KEY'
+        $workflow | Should -Not -Match 'ATLASSIANPS_RELEASE_APP_(?:CLIENT_ID|PRIVATE_KEY)'
+    }
+
+    It 'gives every configured target exactly one explicit release-intent label' {
+        $repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '../..')).ProviderPath
+        $targetsPath = Join-Path $repositoryRoot 'dependency-updates/targets.json'
+        $targets = @(Get-Content -LiteralPath $targetsPath -Raw | ConvertFrom-Json)
+
+        foreach ($target in $targets) {
+            $releaseLabels = @([String]$target.labels -split ',' |
+                    ForEach-Object Trim |
+                    Where-Object { $_ -match '^release:(?:none|patch|minor|major)$' })
+
+            $releaseLabels | Should -HaveCount 1 -Because "$($target.repository) needs explicit release intent"
+        }
+    }
+}

dependency-updates/targets.json

@@ -17,6 +17,6 @@
   {
     "repository": "JiraPS",
     "module": "JiraPS",
-    "labels": "dependencies"
+    "labels": "dependencies,release:none"
   }
 ]