fix: migrate app-id to client-id in workflow app tokens (#92)

The `app-id` input for `actions/create-github-app-token@v3` is
deprecated and will stop working when GitHub forces Node.js 24
(June 16, 2026). Migrate both workflows to use `client-id` with a
repository variable (`vars.APP_CLIENT_ID`) instead of the numeric
App ID secret.

The Client ID is not sensitive (it is public on the App's settings
page), so it is stored as a variable rather than a secret.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

.github/workflows/auto-approve.yml

@@ -36,7 +36,7 @@ jobs:
         if: github.event.pull_request.user.login != 'patchloom-release[bot]'
         id: app-token
         with:
-          app-id: ${{ secrets.APP_ID }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Enable auto-merge

.github/workflows/release.yml

@@ -30,7 +30,7 @@ jobs:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
-          app-id: ${{ secrets.APP_ID }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release