ci: migrate DOCS_REPO_TOKEN to sencho-token-app installation token (#490)

Replace the long-lived DOCS_REPO_TOKEN personal access token with
short-lived installation tokens minted per-job from the sencho-token-app
GitHub App (owned by the AnsoCode org, installed on both Sencho and
sencho-docs).

Why this is better than the PAT:

- Scoped per-job to only the repo the job actually touches, not one
  token that works everywhere. update-screenshots and release-please
  mint against Sencho; sync-docs mints against sencho-docs.
- Scoped per-job to only the permission scopes the job actually needs
  (contents:write and sometimes pull-requests:write), not the broader
  scope a PAT carries.
- Auto-revoked at job end by the action's post-run step, so a leaked
  log line or artifact is useful for at most the remainder of that job.
- Not tied to any individual user account: no more risk of the token
  silently dying when the human who minted it leaves or rotates keys.
- Like a PAT but unlike GITHUB_TOKEN, installation tokens DO trigger
  downstream workflow runs, so the release-please tag push still
  cascades into docker-publish.yml exactly as before.

Jobs migrated:
- release-please.yml: single mint, passed to release-please-action.
- ci.yml update-screenshots: one mint reused by checkout, peter-evans
  create-pull-request, and the gh pr merge step.
- ci.yml sync-docs: one mint targeting sencho-docs, fed to the git
  clone URL as x-access-token.

DOCS_REPO_TOKEN can be deleted from repo secrets after the first full
release cycle under this migration validates release-please,
update-screenshots, and sync-docs all succeed end-to-end.

actions/create-github-app-token pinned to v3.0.0 at SHA
f8d387b68d61c58ab83c6c016672934102569859, consistent with the
SHA-pinning convention established in the supply-chain hardening PR.

.github/workflows/ci.yml

@@ -225,10 +225,24 @@ jobs:
       contents: write
       pull-requests: write
     steps:
+      # Mint a short-lived installation token for the `sencho-token-app`
+      # GitHub App. Reused by the checkout, PR creation, and auto-merge
+      # steps below so we make exactly one /app/installations token call.
+      - name: Generate GitHub App installation token
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: Sencho
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Checkout Code
         uses: actions/checkout@v6
         with:
-          token: ${{ secrets.DOCS_REPO_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Start app & install Playwright
         uses: ./.github/actions/start-app
@@ -240,7 +254,7 @@ jobs:
         id: create-pr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          token: ${{ secrets.DOCS_REPO_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           branch: chore/refresh-screenshots
           commit-message: "docs: refresh screenshots"
           title: "docs: refresh screenshots"
@@ -251,7 +265,7 @@ jobs:
       - name: Auto-merge screenshots PR
         if: steps.create-pr.outputs.pull-request-number != ''
         env:
-          GH_TOKEN: ${{ secrets.DOCS_REPO_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           gh pr merge ${{ steps.create-pr.outputs.pull-request-number }} \
             --squash \
@@ -263,6 +277,21 @@ jobs:
     timeout-minutes: 5
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
+      # This job mirrors docs/ into the sibling sencho-docs repo. The token
+      # must therefore be scoped to `sencho-docs`, not the current repo, so
+      # we mint an installation token explicitly targeting that repo.
+      # Minted unconditionally so the step graph stays simple; the token
+      # auto-revokes on post-step even when the gate below is false.
+      - name: Generate GitHub App installation token
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: sencho-docs
+          permission-contents: write
+
       - name: Checkout Sencho repo
         uses: actions/checkout@v6
         with:
@@ -289,7 +318,7 @@ jobs:
       - name: Clone or init sencho-docs
         if: steps.detect.outputs.changed == 'true'
         env:
-          DOCS_TOKEN: ${{ secrets.DOCS_REPO_TOKEN }}
+          DOCS_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           rm -rf sencho-docs
 

.github/workflows/release-please.yml

@@ -13,11 +13,26 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
+      # Mint a short-lived installation token for the `sencho-token-app`
+      # GitHub App instead of using a long-lived user PAT. The token:
+      #   - is scoped to this one repository (least privilege)
+      #   - requests only the permissions release-please actually needs
+      #   - is auto-revoked by the action's post step at job end
+      #   - unlike GITHUB_TOKEN, CAN trigger downstream workflow runs, so the
+      #     tag push from release-please still cascades to docker-publish.yml
+      - name: Generate GitHub App installation token
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: Sencho
+          permission-contents: write
+          permission-pull-requests: write
+
       - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         with:
-          # GITHUB_TOKEN cannot trigger other workflows (GitHub security restriction).
-          # Using DOCS_REPO_TOKEN (PAT) ensures the tag push from release-please
-          # cascades to docker-publish.yml and publishes to Docker Hub.
-          token: ${{ secrets.DOCS_REPO_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json