From 161d11021ca38d32b837b440171b0172d86b9510 Mon Sep 17 00:00:00 2001
From: Bohdan Triapitsyn <artmore@protonmail.com>
Date: Tue, 9 Jun 2026 19:27:32 +0300
Subject: [PATCH] ci: use app token for automation comments

---
 .github/workflows/pr-review.yml | 17 ++++++++++++-----
 .github/workflows/triage.yml    | 11 +++++++++--
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 00421623..befe1ce0 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -31,10 +31,17 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Generate review app token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OC_REVIEW_APP_ID }}
+          private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }}
+
       - name: Resolve pull request context
         id: pr
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           EVENT_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         run: |
           pr_json="$(gh pr view "$EVENT_PR_NUMBER" --json number,url,title,body,author,baseRefName,headRefName,headRepositoryOwner,isDraft)"
@@ -62,7 +69,7 @@ jobs:
         if: steps.pr.outputs.draft == 'false'
         id: safety
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           PR_NUMBER: ${{ steps.pr.outputs.number }}
         run: |
           changed_sensitive_files="$(gh pr diff "$PR_NUMBER" --name-only | grep -E '^(\.github/workflows/pr-review\.yml|\.opencode/agent/pr-review\.md)$' || true)"
@@ -82,7 +89,7 @@ jobs:
       - name: Skip unsafe review
         if: steps.pr.outputs.draft == 'false' && steps.safety.outputs.safe != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           PR_NUMBER: ${{ steps.pr.outputs.number }}
           CHANGED_SENSITIVE_FILES: ${{ steps.safety.outputs.changed_sensitive_files }}
         run: |
@@ -104,8 +111,8 @@ jobs:
         if: steps.pr.outputs.draft == 'false' && steps.safety.outputs.safe == 'true'
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           PR_URL: ${{ steps.pr.outputs.url }}
           PR_NUMBER: ${{ steps.pr.outputs.number }}
           PR_TITLE: ${{ steps.pr.outputs.title }}
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index e90bf695..20c60aea 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -20,14 +20,21 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Generate bot app token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OC_REVIEW_APP_ID }}
+          private-key: ${{ secrets.OC_REVIEW_APP_PRIVATE_KEY }}
+
       - name: Install opencode
         run: curl -fsSL https://opencode.ai/install | bash
 
       - name: Triage issue
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           ISSUE_URL: ${{ github.event.issue.html_url }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           ISSUE_TITLE: ${{ github.event.issue.title }}