chore(deps): update actions/create-github-app-token action to v3.1.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token	action	minor	v3.0.0 → v3.1.1

---

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

v3.1.1

Compare Source

Bug Fixes

• improve error message when app identifier is empty (#​362) (07e2b76), closes #​249

v3.1.0

Compare Source

Bug Fixes

• deps: bump p-retry from 7.1.1 to 8.0.0 (#​357) (3bbe07d)

Features

• add client-id input and deprecate app-id (#​353) (e6bd4e6)
• update permission inputs (#​358) (076e948)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

v3.1.0 (April 11, 2026)

• New Feature: Added client-id input as a replacement for app-id (app-id is now deprecated but remains fully functional for backward compatibility)
• New Feature: Updated permission inputs through @octokit/openapi upgrade (v21→v22), adding support for permission-discussions and other new GitHub API permissions
• Bug Fix: Upgraded p-retry dependency from 7.1.1 to 8.0.0, improving retry logic and error handling

v3.1.1 (April 11, 2026)

• Bug Fix: Improved error message when app identifier (client-id/app-id) is empty, providing clearer guidance to users about checking secret/variable availability in workflow context (#362, resolves #249)

Breaking Changes: None. The app-id input is deprecated but remains fully functional. The action maintains complete backward compatibility.

Security: No security advisories or vulnerabilities reported for any of these versions.

🎯 Impact Scope Investigation

Usage Location: The action is used only once in the codebase:

• File: .github/workflows/posts.yml:252
• Purpose: Generate GitHub App token for creating and merging pull requests in the automated news pipeline
• Current configuration:

  app-id: ${{ vars.BOT_APP_ID }}
  private-key: ${{ secrets.BOT_PRIVATE_KEY }}
  permission-contents: write
  permission-pull-requests: write

Compatibility Analysis:

• ✅ Current usage with app-id input is fully supported in v3.1.1
• ✅ All permission inputs (permission-contents, permission-pull-requests) remain unchanged
• ✅ No API changes affecting the token output or usage
• ✅ No changes to the private-key input

Dependency Impact:

• The p-retry upgrade is internal to the action and does not affect consumers
• The @octokit/openapi upgrade adds new permission options but doesn't break existing ones

💡 Recommended Actions

Immediate Action:

• ✅ Safe to merge - This is a minor version update with no breaking changes
• The current usage pattern with app-id will continue to work without any modifications

Optional Future Enhancement (not required for this PR):

• Consider migrating from app-id to client-id input in a future update to align with GitHub's current best practices:

  # Current (still supported)
  app-id: ${{ vars.BOT_APP_ID }}
  
  # Recommended future change
  client-id: ${{ vars.BOT_APP_ID }}

• This migration is purely cosmetic and provides no functional benefit; it's only to follow the updated naming convention

No other changes required - The workflow will function identically after this update.

🔗 Reference Links

• v3.1.1 Release Notes
• v3.1.0 Release Notes
• Version Comparison: v3.0.0...v3.1.1
• PR #353: Add client-id input and deprecate app-id
• PR #358: Update permission inputs
• Issue #362: Improve error message for empty app identifier
• GitHub Security Advisories (None reported)

Generated by koki-develop/claude-renovate-review