ci(github-action): update action actions/create-github-app-token (v3.2.0 → v3.3.0)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token	action	minor	v3.2.0 → v3.3.0

---

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features

• update permission inputs (#​399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3 (anthropic) — primary route · pr-reviewer-action v3.4.1

Recommendation

Approve. This is a Renovate-generated minor-version bump of a third-party GitHub Action (actions/create-github-app-token), pinned by commit SHA in four workflow files. The diff is minimal, surgical, and matches the PR's stated scope exactly. All three claims verified against the file contents.

Change-by-change findings

Claim 1 — All workflow sites bump to v3.3.0; no v3.2.0 references remain

Held: 4/4 items. Confirmed via grep over .github:

• .github/workflows/ai-pr-review.yaml:35 → @64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
• .github/workflows/manual-release.yml:28 → @64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
• .github/workflows/publish-release.yml:33 → @64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
• .github/workflows/release-please.yaml:42 → @64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0

Additional checks: git_grep for the old SHA bcd2ba49… returns zero hits repo-wide, and git_grep for create-github-app-token@v?3\.2 also returns zero hits, confirming there is no leftover pinned reference anywhere in the repo.

Claim 2 — Inputs and step id (app-token) are byte-identical; only the uses: line changed

Held: 4/4 items. Confirmed by reading each of the four workflow files. Each diff is exactly one hunk, and the surrounding with: block plus step id: is unchanged:

• ai-pr-review.yaml: client-id: ${{ secrets.BOT_CLIENT_ID }}, private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}, id: app-token — unchanged.
• manual-release.yml: same BOT_CLIENT_ID / BOT_APP_PRIVATE_KEY inputs and id: app-token — unchanged.
• publish-release.yml: same BOT_CLIENT_ID / BOT_APP_PRIVATE_KEY inputs and id: app-token — unchanged. (The other steps already reference steps.app-token.outputs.token with no further changes.)
• release-please.yaml: app-id: ${{ secrets.MISO_APP_ID }}, private-key: ${{ secrets.MISO_APP_PRIVATE_KEY }}, id: app-token — unchanged.

The release notes note this was a minor bump; the with: schema (client-id / private-key / app-id) is unchanged across v3.2.0 → v3.3.0 per the upstream action.yml diff (only new permission-code-quality input added; existing inputs retained).

Claim 3 — Only these four files are modified

Held: 4/4 items. PR metadata reports changedFiles: 4, additions: 4, deletions: 4 — consistent with one line added and one line deleted per file across exactly the four paths. No other repository file mentions create-github-app-token or either SHA.

Standards Compliance

AGENTS.md does not codify any specific SHA-pinning convention for third-party Actions beyond the implicit norm that all Actions in this repo are pinned by SHA with a # vX.Y.Z comment. The PR conforms to that norm (every uses: carries a 40-char SHA and a version comment). No repository standard is violated.

Notes from AGENTS.md that are not triggered by this PR:

• The Lint/typecheck blocks CI requirement is unaffected — workflow files are YAML, not TS, and Workflow lint is reported success in CI.
• The token-secret requirement is unaffected — no secret-handling changes; the action's existing inputs (client-id/private-key/app-id) keep their pre-existing secrets.* references unchanged.

Tool Harness Findings

12 tool calls across 5 rounds; all succeeded. The corpus already shows the relevant findings; key signals:

• Workflow-lint, lint, typecheck, build, tests, and Docker Build all reported success on commit 9305b4e.
• Coverage, Database integration, Database migrations, smoke, npm audit, and renovate/stability-days all success.
• The single publish-release check is skipped, which is expected — it runs on pull_request_target events for release branches, not for head-commit CI on a Renovate PR.

No tool-harness findings to flag.

Unknowns or Needs Verification

None. Every claim was checked against the on-disk file contents and the only material change is a SHA bump with identical surrounding context. The upstream v3.3.0 release was independently confirmed via the linked-source actions/create-github-app-token/releases/tag/v3.3.0 metadata (published 2026-10-12), and the upstream action.yml diff shows new optional permission-code-quality input only — existing inputs used by this repo are preserved.

Verdict rationale

Surgical, SHA-pinned, Renovate-blessed minor-version bump across the expected four workflow files with no leftover references to the prior version, no change to step inputs or step ids, and a green CI on the head commit. No blockers, majors, or even minors observed. Approve.