ci: mint a GitHub App token for release-plz instead of using a PAT - #537

Tracked by #536. Draft — cannot be merged as-is, see blockers below.

Stacked on #535; rebase onto main once that lands. The diff shown here is against fix/vault-secrets-env-wiring, so it contains only the credential change.

What

Replace the static PAT at ci/repo/grafana/augurs/github:token with an ephemeral GitHub App installation token from grafana/shared-workflows/actions/create-github-app-token, which authenticates to Vault over the same OIDC flow get-vault-secrets already uses. That PAT expired around 2026-06-16 (gh: Bad credentials (HTTP 401)), and we've moved away from PATs org-wide, so rotating it isn't the answer.

CARGO_REGISTRY_TOKEN stays in Vault via get-vault-secrets — crates.io has no App-token equivalent — so both jobs keep that step, just with one fewer secret in it.

Both jobs already declare id-token: write, which is all create-github-app-token needs, so no permission changes.

Blockers

• The GitHub App doesn't exist yet. github_app: augurs-release is a placeholder and must be replaced with the real name; there's a TODO on both steps pointing at ci: replace the static GitHub PAT in Vault with a GitHub App token for release-plz #536. As written this workflow will fail to mint a token.
• The App needs contents: write and pull_requests: write, installed on grafana/augurs, and registering with Vault. If it's set up with a non-default permission set, add permission_set: to both steps.

Why an App token rather than the default GITHUB_TOKEN

release-plz opens the release PR, and PRs opened with the default GITHUB_TOKEN cannot trigger other workflows — CI would never run on the release PR. An App installation token isn't subject to that, which is why a PAT was used in the first place.

Verification

Release-plz only triggers on push to main, so this can't be proven green from a PR — the first push to main after merge is the real test. actionlint is clean and the YAML parses to the expected values, which is as far as static checking goes here.

Once this merges and a run is green, ci/repo/grafana/augurs/github:token can be deleted from Vault.

🤖 Generated with Claude Code