chore(deps): update actions/create-github-app-token action to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token	action	major	v2 → v3

---

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

v3.2.0

Compare Source

Features

• add support for enterprise-level GitHub Apps (#​263) (952a2a7)
• support full repository names in repositories input (#​372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#​364) (43e5c34)
• validate private-key input (#​376) (f24bbd8)

v3.1.1

Compare Source

Bug Fixes

• improve error message when app identifier is empty (#​362) (07e2b76), closes #​249

v3.1.0

Compare Source

Bug Fixes

• deps: bump p-retry from 7.1.1 to 8.0.0 (#​357) (3bbe07d)

Features

• add client-id input and deprecate app-id (#​353) (e6bd4e6)
• update permission inputs (#​358) (076e948)

v3.0.0

Compare Source

• feat!: node 24 support (#​275) (2e564a0)
• fix!: require NODE_USE_ENV_PROXY for proxy support (#​342) (4451bcb)

Bug Fixes

• remove custom proxy handling (#​143) (dce0ab0)

BREAKING CHANGES

• Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
• Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner.

v3

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/release-plz.yml">

<violation number="1" location=".github/workflows/release-plz.yml:21">
P3: With `actions/create-github-app-token@v3`, `app-id` is deprecated. Switch to `client-id` to avoid deprecation warnings and align with the v3-recommended input.</violation>
</file>

_{Partial review: This PR has more than 50 files, so cubic reviewed the highest-priority files first. During the trial, paid plans get a higher file limit.
You can try an ultrareview to bypass the file limit, comment @cubic-dev-ai ultrareview. Learn more.
Fix all with cubic.}

[cubic-dev-ai]

P3: With actions/create-github-app-token@v3, app-id is deprecated. Switch to client-id to avoid deprecation warnings and align with the v3-recommended input.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release-plz.yml, line 21:

<comment>With `actions/create-github-app-token@v3`, `app-id` is deprecated. Switch to `client-id` to avoid deprecation warnings and align with the v3-recommended input.</comment>

<file context>
@@ -18,7 +18,7 @@ jobs:
       - name: Generate App token
         id: app-token
-        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
         with:
           app-id: ${{ vars.RELEASE_APP_ID }}
</file context>

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e696f12. Configure here.}

[cursor]

Deprecated app-id input used after v3 upgrade

Low Severity

The upgrade to actions/create-github-app-token v3 introduces usage of the deprecated app-id input. In v3.1.0, app-id was deprecated in favor of client-id. While app-id still works as a fallback, the v3 migration is incomplete — a deprecation warning will appear in CI logs, and the input may be removed in a future release.

 

^{Reviewed by Cursor Bugbot for commit e696f12. Configure here.}