Problem
Pull requests created by the Claude triage workflow use the repository GITHUB_TOKEN. GitHub places workflows triggered by those PRs into an approval-required state, preventing fully automatic CI and review execution.
Proposed change
- Authenticate branch pushes and PR creation as the installed Imagile Bot GitHub App instead of
github-actions[bot].
- Generate a short-lived installation token with
actions/create-github-app-token.
- Store the App ID as a repository Actions variable and its private key as an encrypted Actions secret.
- Keep the built-in
GITHUB_TOKEN permissions least-privileged.
- Verify the workflow configuration without exposing credentials.
Acceptance criteria
- Triage-created branches and PRs are attributed to Imagile Bot.
- PR workflows start without the special approval required for
GITHUB_TOKEN-created PRs.
- No private-key material is committed or logged.
- Existing issue triage, branch push, PR creation, and issue-linking behavior remains intact.
Problem
Pull requests created by the Claude triage workflow use the repository
GITHUB_TOKEN. GitHub places workflows triggered by those PRs into an approval-required state, preventing fully automatic CI and review execution.Proposed change
github-actions[bot].actions/create-github-app-token.GITHUB_TOKENpermissions least-privileged.Acceptance criteria
GITHUB_TOKEN-created PRs.