From 09a8196a7962d01b316919e8f189e5c7a9b3e8fa Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sat, 19 Sep 2026 19:20:45 +0100
Subject: [PATCH] ci: pass the App client ID to create-github-app-token instead
 of the deprecated app-id

actions/create-github-app-token@v3 deprecated its app-id input in favour of client-id.
The client IDs are public, so they are written inline, matching documents.js:
the exadev App for the release push, the Documents.js App for auto-merge,
and the ExaDev Sync App for the hive dispatch.
Each was read from the GitHub Apps API and its numeric id checked against the value it replaces.
---
 .github/workflows/ci.yml                    | 5 +++--
 .github/workflows/dependabot-auto-merge.yml | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ab2c0b2..b119123 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -197,7 +197,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ secrets.GH_APP_ID }}
+          client-id: Iv23liLMzahHqi38Qo4c
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
       - uses: actions/checkout@v7
         with:
@@ -265,7 +265,8 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: "4816274"
+          # Public client ID of the ExaDev Sync App (numeric id 4816274), the App whose private key is HIVE_DISPATCH_APP_PRIVATE_KEY.
+          client-id: Iv23li7JN6kJDQqQ3pbA
           private-key: ${{ secrets.HIVE_DISPATCH_APP_PRIVATE_KEY }}
           owner: novus-power
           repositories: |
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 206d74a..e436068 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -35,7 +35,8 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: "4473709"
+          # Public client ID of the Documents.js App (numeric id 4473709), the App whose private key is AUTOMERGE_APP_PRIVATE_KEY.
+          client-id: Iv23liuX19EFyXndAmkL
           private-key: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }}
       - name: Enable auto-merge
         if: steps.decide.outputs.merge == 'true'