[jonahgabriel]

Summary

Wires the release-sync push identity in .github/workflows/release.yml's Sync main to release tag step to use a minted onexbot-occ-writer GitHub App installation token instead of the default workflow GITHUB_TOKEN.

Context (OMN-16343)

main branch protection restricts pushes to a named automation identity and empties required_status_checks on main (OMN-16289). The workflow's default GITHUB_TOKEN cannot satisfy that push restriction — proven live on omnibase_core: GH006 "protected branch update failed", 2026-08-21, and confirmed by an A/B check across omnimarket vs omnibase_core today (2026-08-21) that the same default-token push pattern is broken identically in both repos.

Fix: mint a short-lived installation token for the org-owned GitHub App onexbot-occ-writer (org secrets ONEXBOT_OCC_APP_ID / ONEXBOT_OCC_PRIVATE_KEY, visibility to this repo verified in preflight) via actions/create-github-app-token@v1 (SHA-pinned, same canonical mint pattern already used elsewhere in this repo, e.g. call-occ-attestation-observe.yml), scoped to owner: OmniNode-ai, repositories: omnibase_infra only, and push the release main-sync as that app identity instead of origin.

Minimal diff: only the Sync main to release tag step and its preceding comment block are touched. The OMN-16323 injection-hardening pattern (env: RELEASE_TAG, no raw tag interpolation into shell) is untouched, and the unrelated CROSS_REPO_PAT repository-dispatch job (trigger-runtime-rebuild) is untouched.

Restrictions re-add on main happens only after an observed release sync proves this token path.

Test plan

• Pre-commit --files .github/workflows/release.yml — all applicable hooks pass
• Governed pre-push impacted-test selector — 1550 passed
• gh pr checks green
• Real proof is an actual release run exercising the Sync main to release tag step with the app token (next tagged release)

Evidence-Ticket: OMN-16343
Evidence-Source: OCC#6827

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in: 52 minutes

Limit details: You’ve used the included review currently available. Your 117 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b6223723-401c-4895-9dcd-91e5f6066df1

📥 Commits

Reviewing files that changed from the base of the PR and between 6d5ea5b and 0324ca9.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[onexbot-occ-writer]

OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required.

[github-actions]

✅ Hostile Reviewer — PASSED

Blocking findings (critical): 0
Total findings: 0
Models succeeded: qwen3-review,qwen3-review-b

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical findings	No
blocked	CRITICAL findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8468/OMN-8524)