fix: use kernel-internal GitHub App token in workflows

[rgarcia]

Summary

Switches workflows from using GITHUB_TOKEN/GH_PAT to the kernel-internal GitHub App token, aligning with the pattern used in the main kernel repo.

Changes

fix-ci.yaml

• Added app token generation step using actions/create-github-app-token@v1
• Updated checkout action to use app token for push access
• Replaced secrets.GITHUB_TOKEN with steps.app-token.outputs.token in GH_TOKEN env var
• Updated git identity to kernel-internal[bot] / 260533166+kernel-internal[bot]@users.noreply.github.com

release.yaml

• Added app token generation step using actions/create-github-app-token@v1
• Replaced secrets.GH_PAT with steps.app-token.outputs.token in GITHUB_TOKEN env var for GoReleaser

Benefits

• Consistent authentication pattern across repos
• Better security with GitHub App tokens vs PATs
• Proper attribution for automated commits/releases

Testing

The workflows will use the existing ADMIN_APP_ID and ADMIN_APP_PRIVATE_KEY secrets already configured in the repository.

---

Note

Medium Risk
Changes release and automation credentials/permissions; misconfiguration could break CI auto-fix pushes or tagged releases/publishing even though no product code changes.

Overview
Switches the Fix CI Failures and Release CLI GitHub Actions workflows to authenticate via a generated GitHub App token (actions/create-github-app-token@v1) instead of GITHUB_TOKEN/PATs.

The CI-fix workflow now checks out/pushes and runs gh using the app token and updates commit attribution to kernel-internal[bot]; the release workflow similarly feeds the app token to GoReleaser (scoped to cli and homebrew-tap).

^{Written by Cursor Bugbot for commit 92b320a. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

• ✅ Fixed: App token lacks cross-repo access for homebrew tap
  • Added 'repositories: cli,homebrew-tap' to the create-github-app-token step so the generated token has access to both the current repo (for releases) and the kernel/homebrew-tap repo (for formula updates).

Or push these changes by commenting:

@cursor push d312379d71

Preview (d312379d71)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -19,6 +19,7 @@
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
+          repositories: cli,homebrew-tap
 
       - name: Checkout
         uses: actions/checkout@v4

[rgarcia]

@cursor push d312379