ci: migrate workflow auth from PAT to GitHub App tokens - #3004

@BugBot run

🔍 Dyadbot Code Review Summary

Verdict: ✅ YES - Ready to merge

Reviewed by 3 independent agents: Correctness Expert, Code Health Expert, UX Wizard.

Clean, straightforward migration from PAT-based auth to GitHub App tokens. The changes are consistent across both workflow files, permissions are appropriately scoped, and the pattern follows best practices for GitHub Actions auth.

Issues Summary

No HIGH or MEDIUM issues found.

Generated by Dyadbot multi-agent code review

Greptile Summary

This PR improves the CI security posture by replacing long-lived personal access tokens (PR_RW_GITHUB_TOKEN) with short-lived, scoped GitHub App tokens in two workflows (draft-stale-prs and label-rebase-prs). The change uses actions/create-github-app-token@v2 to generate tokens with explicit permission scopes, which is the recommended approach.

• The draft-stale-prs.yml migration looks correct: it requests permission-contents: read, permission-pull-requests: write, and permission-issues: write, matching the REST and GraphQL operations performed. The only cosmetic issue is a now-redundant workflow-level permissions block for the unused GITHUB_TOKEN.
• label-rebase-prs.yml has a likely runtime bug: it requests only permission-pull-requests: write but calls github.rest.issues.addLabels, which requires issues: write in GitHub's App permission model. This will likely result in a 403 Forbidden error when the workflow tries to apply the cc:rebase label.
• Both workflows use actions/create-github-app-token@v2 with a mutable major-version tag rather than a pinned commit SHA — a supply-chain security consideration given that this action handles the App private key.

Confidence Score: 2/5

• Not safe to merge as-is — label-rebase-prs.yml is missing issues: write permission, which will cause the label step to fail at runtime.
• The overall migration direction is correct and a security improvement. However, label-rebase-prs.yml omits the issues: write permission required by the issues.addLabels API call, making the workflow functionally broken after this change. The draft-stale-prs.yml migration is correct but has a minor stale permissions block. The missing permission is a concrete runtime failure, not a theoretical concern.
• .github/workflows/label-rebase-prs.yml — missing permission-issues: write for the issues.addLabels call.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Runner as GitHub Actions Runner
    participant TokenAction as create-github-app-token
    participant GitHubApp as Dyad GitHub App
    participant ScriptAction as github-script
    participant API as GitHub REST/GraphQL API

    Runner->>TokenAction: app-id + private-key (scoped permissions)
    TokenAction->>GitHubApp: JWT exchange for installation token
    GitHubApp-->>TokenAction: Short-lived scoped token
    TokenAction-->>Runner: outputs.token

    Runner->>ScriptAction: Pass App token as github-token
    ScriptAction->>API: Authenticated REST and GraphQL calls
    API-->>ScriptAction: Responses (PR updates, labels, comments)

This is a comment left during a code review.
Path: .github/workflows/label-rebase-prs.yml
Line: 22-23

Comment:
**Missing `issues: write` permission for label operations**

The `github.rest.issues.addLabels` call (line 74) uses the GitHub Issues REST API (`POST /repos/{owner}/{repo}/issues/{issue_number}/labels`). GitHub Apps require the `issues: write` permission to manage labels on issues and pull requests — `pull_requests: write` alone is not sufficient for this endpoint.

The `draft-stale-prs.yml` workflow correctly requests `permission-issues: write` for its comment creation (`issues.createComment`). By analogy, this workflow also needs `issues: write` for label management.

Without this permission, the App token will likely receive a `403 Forbidden` response when attempting to add the `cc:rebase` label.

```suggestion
          permission-contents: read
          permission-pull-requests: write
          permission-issues: write
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: .github/workflows/draft-stale-prs.yml
Line: 8-11

Comment:
**Stale workflow-level `permissions` block**

Now that all privileged operations use the GitHub App token (from `steps.app-token.outputs.token`) rather than the built-in `GITHUB_TOKEN`, the top-level `permissions` block only applies to `GITHUB_TOKEN`, which is no longer used for any write operations. `pull-requests: write` and `issues: write` are therefore granted to an unused token. Consider reducing these to `contents: read` only (or removing the block entirely and relying on the org/repo default), to follow the principle of least privilege.

```suggestion
permissions:
  contents: read
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: .github/workflows/draft-stale-prs.yml
Line: 20

Comment:
**Action not pinned to a commit SHA**

`actions/create-github-app-token@v2` uses a mutable major-version tag. This action handles the GitHub App's private key (`DYAD_GITHUB_APP_PRIVATE_KEY`), making it a high-value supply-chain target. A compromised or accidentally updated tag could exfiltrate secrets. Best practice is to pin to a full commit SHA, e.g.:

```suggestion
        uses: actions/create-github-app-token@v2  # pin to a commit SHA, e.g. @<sha>
```

The same concern applies in `label-rebase-prs.yml` line 18.

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 6ad8d49}

🎭 Playwright Test Results

❌ Some tests failed

Summary: 256 passed, 2 failed, 7 flaky, 6 skipped

Failed Tests

🍎 macOS

• select_component.spec.ts > select component next.js
  • Error: expect(locator).toBeVisible() failed
• template-create-nextjs.spec.ts > create next.js app
  • Error: expect(locator).toBeVisible() failed

📋 Re-run Failing Tests (macOS)

Copy and paste to re-run all failing spec files locally:

npm run e2e \
  e2e-tests/select_component.spec.ts \
  e2e-tests/template-create-nextjs.spec.ts

⚠️ Flaky Tests

🍎 macOS

• approve.spec.ts > write to index, approve, check preview (passed after 1 retry)
• chat_tabs.spec.ts > right-click context menu: Close tabs to the right (passed after 1 retry)
• fix_error.spec.ts > fix error with AI (passed after 1 retry)
• new_chat.spec.ts > new chat (second button) (passed after 1 retry)
• refresh.spec.ts > preview navigation - forward and back buttons work (passed after 1 retry)
• setup_flow.spec.ts > Setup Flow > setup banner shows correct state when node.js is installed (passed after 1 retry)
• setup.spec.ts > setup ai provider (passed after 1 retry)

📊 View full report