Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:
vars.APP_ID / secrets.APP_PRIVATE_KEY -> GHAPP_HEADERS_*
secrets.APP_{ID,KEY}_APPROVE_AND_MERGE -> GHAPP_MERGEBOT_*
vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
secrets.PB_BOT_APP_{ID,PRIVATE_KEY} -> GHAPP_PBBOT_*
Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:
secrets.POCKETBASE_URL -> vars.POCKETBASE_URL
secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
secrets.FRONTEND_URL -> vars.FRONTEND_URL (also replaces vars.SITE_URL)
The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:
REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
BREAKING_CHANGE_INGEST_SECRET -> FRONTEND_ADVISORY_SECRET
PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.
* Bump GitHub Actions across workflows
Update workflow dependencies to newer major versions in repository automation files. This upgrades `actions/checkout` to v7, `actions/github-script` to v9, `actions/create-github-app-token` to v3, and GitHub Pages actions (`upload-pages-artifact` and `deploy-pages`) to v5 to keep CI/CD and maintenance workflows current.
* add dependabot for gh actions
Refactor the workflow to prefer back-references stamped in PR bodies over fuzzy title/slug matching. Add safety guard refusing to close more than 3 issues per PR. Restrict issue search to migration-labelled issues only. Use exact slug matching instead of substring matching. Add permissions block, env var for DEV_REPO, and skip already-closed issues.
- close-new-script-prs: trigger on added script file OR label, exempt by
author_association (OWNER/MEMBER/COLLABORATOR) instead of team API
- close_issue_in_dev: match VED issues by derived slug, close all matches
- lock-issue: lock closed issues after 7 days instead of 3
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
