ci(release): push the Version Packages PR with a GitHub App token so CI runs on it

[PunGrumpy]

Description

Every pull_request workflow on the Version Packages PR has been dead since the very first release PR (#1): Code Quality, CodeQL, Docker Doctor, React Doctor and, since #121, Kit Push all end as action_required or as a failure with zero jobs and no log. GitHub labels the zero-job runs "likely failed because of a workflow file issue", but the workflow files at those SHAs are byte-identical to main. The latest instance is https://github.com/PunGrumpy/docker-doctor/actions/runs/33961927574 on #125.

The cause is the token, not the workflows: changesets/action/version pushes changeset-release/main with the default GITHUB_TOKEN, and GitHub never starts workflows for events created by that token. The release itself is unaffected (0.5.1 published with provenance, kit 0.1.6 pushed), only the PR never gets CI.

This PR makes the Version job mint a GitHub App token and hand it to changesets/action/version as github-token, so the PR is authored by the App and the workflows run on it.

• actions/create-github-app-token@v3 requests only contents: write and pull-requests: write.
• The step is gated on the RELEASE_APP_ID repository variable (a variable, not a secret, because step if cannot read secrets). Until the variable and the RELEASE_APP_PRIVATE_KEY secret exist the step is skipped and github-token falls back to github.token, so this is safe to merge before the App is set up.
• The one-time setup lives in a comment next to the step: create an App with Contents + Pull requests write, install it on this repo, set RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY.

Related Issues

N/A. Found while investigating the failed Kit Push run on #125.

Checklist

• I've reviewed my code
• I've written tests
• I've generated a changeset file, if this changes a published package
• I've updated the docs, if necessary

Screenshots (if applicable)

N/A

Additional Notes

Verified locally with actionlint on both commits and with the repo formatter; the YAML parses. The behaviour change cannot be exercised until the App variable and secret are set. The first Version Packages PR after that should show the five workflows actually running instead of action_required.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docker-doctor	Ready	Preview	Sep 7, 2026 3:05am UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: bf1e7ba

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

The latest Docker Doctor scan for this pull request. Learn more about Docker Doctor.

File	Status	Issues	Updated
Dockerfile	Error	1 error, 2 info	Sep 7, 2026 3:05am UTC

Score: 84 / 100 · Good

3 issues

Dockerfile

• Dockerfile:2 Potential secret found in ENV: 'DB_PASSWORD'. no-secrets-in-env
• Dockerfile:1 No HEALTHCHECK instruction found. require-healthcheck
• Dockerfile:1 No LABEL metadata was found in this Dockerfile. require-labels

_{Scanned by Docker Doctor for commit bf1e7ba.}