ci(deps): bump actions/create-github-app-token from 2.2.2 to 3.2.0

[dependabot]

Bumps actions/create-github-app-token from 2.2.2 to 3.2.0.

Release notes

Sourced from actions/create-github-app-token's releases.

v3.2.0

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

• improve error message when app identifier is empty (#362) (07e2b76), closes #249

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

• deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

• add client-id input and deprecate app-id (#353) (e6bd4e6)
• update permission inputs (#358) (076e948)

v3.0.0

3.0.0 (2026-03-14)

• feat!: node 24 support (#275) (2e564a0)
• fix!: require NODE_USE_ENV_PROXY for proxy support (#342) (4451bcb)

Bug Fixes

• remove custom proxy handling (#143) (dce0ab0)

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

Commits

• bcd2ba4 chore(main): release 3.2.0 (#370)
• f24bbd8 fix: validate private-key input (#376)
• 363531b docs: capitalize Git as a proper noun in README (#374)
• fd28011 docs: update procedure to configure Git (#287)
• 85eb8dd feat: support full repository names in repositories input (#372)
• c9aabb8 build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...
• e02e816 build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)
• 8d835bf build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...
• 952a2a7 feat: add support for enterprise-level GitHub Apps (#263)
• 43e5c34 fix(deps): bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependenc...
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

• Chores
  • Updated the reusable GitHub workflow to pin the community fork token generation action to a specific commit (v3.2.0) for improved stability and security.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

📝 Walkthrough

Walkthrough

The reusable workflow .github/workflows/reusable-claude-on-pr.yaml updates the pinned commit SHA for the actions/create-github-app-token action in the "Generate community fork token" step, moving from the v2 pin to the v3.2.0 pin. No other workflow logic, inputs, outputs, or steps are modified.

Possibly related PRs

• openshift/hypershift#8776: Directly related — also migrates the actions/create-github-app-token version/commit pin inside the same reusable-claude-on-pr.yaml workflow file.

Suggested reviewers

• sjenning
• Nirshal

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: bumping a dependency from version 2.2.2 to 3.2.0, which matches the PR's primary objective.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only modifies GitHub Actions workflow configuration, not Ginkgo test files. The check for stable test names in Ginkgo tests is not applicable since no test code is modified.
Test Structure And Quality	✅ Passed	This check for Ginkgo test quality is not applicable to this PR, which only updates a GitHub Actions workflow dependency (actions/create-github-app-token v2→v3.2.0). No test code is modified.
Topology-Aware Scheduling Compatibility	✅ Passed	PR updates only a GitHub Actions workflow file (reusable-claude-on-pr.yaml), not deployment manifests, operator code, or controllers. Check scope does not apply.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR only updates a GitHub Actions workflow dependency version and contains no new Ginkgo e2e tests, making the IPv6/disconnected network compatibility check not applicable.
No-Weak-Crypto	✅ Passed	PR only updates external action version; no weak crypto (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB), custom crypto, or insecure token comparisons found in repository.
Container-Privileges	✅ Passed	No privileged container/K8s configurations found. PR only modifies a GitHub Actions workflow file to update action dependencies, not container manifests.
No-Sensitive-Data-In-Logs	✅ Passed	PR updates actions/create-github-app-token from v2 to v3.2.0. The workflow properly passes secrets to the action via inputs and does not directly log sensitive data. GitHub Actions automatically ma...
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/actions/create-github-app-token-3.2.0

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign bryan-cox for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/reusable-claude-on-pr.yaml (1)

65-73: ⚠️ Potential issue | 🟡 Minor

Replace deprecated app-id input with client-id.

The app-id input is deprecated in v3.2.0 and should be replaced with client-id. Update line 70 from:

app-id: ${{ secrets.JIRA_SOLVE_CI_APP_ID }}

to:

client-id: ${{ secrets.JIRA_SOLVE_CI_APP_ID }}

The repositories input at line 73 currently uses the short repository name (hypershift). While the action accepts this format, consider updating it to the full repository name (hypershift-community/hypershift) for clarity and explicit intent.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/reusable-claude-on-pr.yaml around lines 65 - 73, Replace
the deprecated `app-id` input with `client-id` in the Generate community fork
token step that uses the actions/create-github-app-token action. Change the line
containing `app-id: ${{ secrets.JIRA_SOLVE_CI_APP_ID }}` to `client-id: ${{
secrets.JIRA_SOLVE_CI_APP_ID }}` to align with the v3.2.0 action specification.
Additionally, update the `repositories` input from the short name `hypershift`
to the full repository path `hypershift-community/hypershift` for clarity and
explicitness.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/reusable-claude-on-pr.yaml:
- Around line 65-73: Replace the deprecated `app-id` input with `client-id` in
the Generate community fork token step that uses the
actions/create-github-app-token action. Change the line containing `app-id: ${{
secrets.JIRA_SOLVE_CI_APP_ID }}` to `client-id: ${{ secrets.JIRA_SOLVE_CI_APP_ID
}}` to align with the v3.2.0 action specification. Additionally, update the
`repositories` input from the short name `hypershift` to the full repository
path `hypershift-community/hypershift` for clarity and explicitness.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 5e093436-85de-45a8-8337-5f1744c1f34d

📥 Commits

Reviewing files that changed from the base of the PR and between 0096c63 and d14299c.

📒 Files selected for processing (1)

• .github/workflows/reusable-claude-on-pr.yaml

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/reusable-claude-on-pr.yaml (1)

68-73: Consider migrating from the deprecated app-id input to client-id.

The actions/create-github-app-token@v3.2.0 action maintains backward compatibility with the app-id input on line 70, so your workflow will continue to function. However, app-id is now deprecated in favor of client-id, which is the preferred input moving forward. Plan to migrate to client-id in a future update.

Additionally, verify that your GitHub App token is configured with appropriate scopes and does not inherit blanket installation permissions, per the least-privilege principle.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/reusable-claude-on-pr.yaml around lines 68 - 73, In the
actions/create-github-app-token action step, replace the deprecated app-id input
with the client-id input. Change the line that currently specifies app-id: ${{
secrets.JIRA_SOLVE_CI_APP_ID }} to use client-id instead, and ensure the
corresponding secret reference (JIRA_SOLVE_CI_APP_ID) is updated if necessary to
match your GitHub App's client ID. This aligns with the latest best practices
for the action while maintaining the same functionality.

Sources: Coding guidelines, Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/reusable-claude-on-pr.yaml:
- Around line 68-73: In the actions/create-github-app-token action step, replace
the deprecated app-id input with the client-id input. Change the line that
currently specifies app-id: ${{ secrets.JIRA_SOLVE_CI_APP_ID }} to use client-id
instead, and ensure the corresponding secret reference (JIRA_SOLVE_CI_APP_ID) is
updated if necessary to match your GitHub App's client ID. This aligns with the
latest best practices for the action while maintaining the same functionality.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 55397959-7269-488a-97c6-dfab526c03c7

📥 Commits

Reviewing files that changed from the base of the PR and between d14299c and 27f2ef5.

📒 Files selected for processing (1)

• .github/workflows/reusable-claude-on-pr.yaml

[openshift-ci]

@dependabot[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

Stale PRs are closed after 21d of inactivity.

If this PR is still relevant, comment to refresh it or remove the stale label.
Mark the PR as fresh by commenting /remove-lifecycle stale.

If this PR is safe to close now please do so with /close.

/lifecycle stale

[openshift-ci]

Stale PRs rot after 14d of inactivity.

Mark the PR as fresh by commenting /remove-lifecycle rotten.
Rotten PRs close after an additional 7d of inactivity.

If this PR is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[openshift-ci]

Rotten PRs close after 7d of inactivity.

Reopen the PR by commenting /reopen.
Mark the PR as fresh by commenting /remove-lifecycle rotten.

/close

[openshift-ci]

@openshift-ci[bot]: Closed this PR.

Details

In response to this:

Rotten PRs close after 7d of inactivity.

Reopen the PR by commenting /reopen.
Mark the PR as fresh by commenting /remove-lifecycle rotten.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.