From 5ed8cfd2f2b5f2124c139552a529d842db085d9a Mon Sep 17 00:00:00 2001
From: Mona <monajhzhu@gmail.com>
Date: Wed, 12 Aug 2026 11:06:29 -0700
Subject: [PATCH] fix: author version-bump PRs as GitHub App

Bump PRs were authored by the personal PAT's owner, who then couldn't
approve their own PRs (main requires one review). Mint a short-lived
app token instead so bump PRs are bot-authored and anyone on the team
can approve.
---
 .github/workflows/version-bump.yaml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/version-bump.yaml b/.github/workflows/version-bump.yaml
index 624122b..eabb684 100644
--- a/.github/workflows/version-bump.yaml
+++ b/.github/workflows/version-bump.yaml
@@ -14,10 +14,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      # Mint a short-lived token as the c3d-version-bump GitHub App. Bump PRs are
+      # then authored by the app bot, so any team member (including whoever wrote
+      # the commits being released) can approve them.
+      - uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ vars.VERSION_BUMP_APP_ID }}
+          private-key: ${{ secrets.VERSION_BUMP_APP_KEY }}
+
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.VERSION_BUMP_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Determine version bump type
         id: bump
@@ -66,7 +75,7 @@ jobs:
       - name: Create version bump PR
         if: steps.bump.outputs.type != 'none'
         env:
-          GH_TOKEN: ${{ secrets.VERSION_BUMP_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           NEW_VERSION=${{ steps.version.outputs.new_version }}
           BRANCH="chore/bump-version-to-${NEW_VERSION}"