ci: scope down release/sync-docs to dedicated GitHub Apps

[rrabenda]

Summary

Reduce the attack surface of release & docs-sync workflows by replacing the shared, over-privileged CI bot with two dedicated, minimally scoped GitHub Apps gated behind protected environments. Mirrors the same change in genlayer-testing-suite#78.

• publish.yml — environment renamed npm → Publish, switched from the archived tibdex/github-app-token@v2 to the official actions/create-github-app-token@v3. Reads vars.PUBLISH_CI_APP_CLIENT_ID and secrets.PUBLISH_CI_APP_KEY.
• sync-docs.yml (renamed from cli-docs.yml for cross-repo consistency with genlayer-testing-suite) — bumped actions/create-github-app-token to @v3, switched to the explicit client-id parameter, gated behind the Sync-docs environment. Reads vars.DOCS_SYNC_APP_CLIENT_ID and secrets.DOCS_SYNC_APP_KEY. Cross-repo repositories: genlayer-docs token request is preserved.

Each App should be installed only on the repos it needs (Publish: this repo only; Sync-docs: this repo + genlayer-docs) with Contents: Read & write as the only permission.

Pre-merge checklist (GitHub side)

• Publish environment exists with PUBLISH_CI_APP_CLIENT_ID (variable) and PUBLISH_CI_APP_KEY (secret)
• Move/recreate the existing NPM_TOKEN (or whatever release-it uses for npm publish) from the old npm environment into the new Publish environment, then delete the npm environment
• Sync-docs environment exists with DOCS_SYNC_APP_CLIENT_ID (variable) and DOCS_SYNC_APP_KEY (secret)
• Both Apps installed on genlayer-cli (sync-docs App also on genlayer-docs) with only Contents: Read & write
• Publish App added to branch-protection bypass list on main and staging (release-it pushes the version-bump commit + tag)
• Sync-docs environment "Deployment branches and tags" allows the v* tag pattern (otherwise release: published on a tag ref will be blocked)

Test plan

• Land a fix: or feat: commit on staging and confirm publish.yml mints a token, release-it pushes the version bump + tag, the GitHub Release is created, and the npm beta upload succeeds
• Repeat on main for a stable release
• Confirm sync-docs.yml fires automatically on release: published and pushes the API-reference update to genlayer-docs
• Once verified, decommission the old shared CI App from this repo and rotate / revoke its secrets

Notes / follow-ups

• sync-docs.yml job-level permissions: contents: read is left as-is in this PR. The "commit and push docs back to CLI repo" step (line ~52-63) writes to the CLI repo using the default GITHUB_TOKEN, which would require contents: write. Either that step has never produced a diff, or it's been silently failing — worth verifying separately.

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflows to use the newer GitHub App token flow with client-id/private-key inputs and updated token variable names.
  • Added an explicit environment for the documentation sync job.
  • Migrated token usage across release and docs sync steps to the updated authentication mechanism.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0ab36185-82b2-4f61-97da-6d3993b46bc3

📥 Commits

Reviewing files that changed from the base of the PR and between 73f779c and 690c577.

📒 Files selected for processing (1)

• .github/workflows/sync-docs.yml

---

📝 Walkthrough

Walkthrough

Workflows for publishing and documentation sync were updated to use actions/create-github-app-token@v3 (client-id + private-key inputs) and to reference environment-specific variables/secrets; publish.yml job environment changed to Publish and sync-docs.yml job environment added (Sync-docs).

Changes

GitHub Actions Token Migration

Layer / File(s)	Summary
Environment Setup .github/workflows/publish.yml, .github/workflows/sync-docs.yml	publish.yml job environment changed from npm to Publish; sync-docs.yml job gains environment: Sync-docs.
Token Generation .github/workflows/publish.yml	Replaced tibdex/github-app-token@v2 usage with actions/create-github-app-token@v3; inputs now use client-id and private-key and new env-specific variable names (e.g., PUBLISH_CI_APP_CLIENT_ID, PUBLISH_CI_APP_KEY).
Token Generation / Wiring .github/workflows/sync-docs.yml	Replaced older token action (v1) with actions/create-github-app-token@v3 using client-id; updated steps to pass generated app-token.token into subsequent checkout and related steps.
Minor Workflow Step Adjustments .github/workflows/publish.yml, .github/workflows/sync-docs.yml	Adjusted step inputs and references to use the token output and new secret/variable names; other workflow steps (checkout, setup-node, npm ci, release, docs generation) remain unchanged.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Suggested reviewers

• cristiam86

Poem

🔐 I nibble keys beneath moon's light,

client-id snug, private-key tight.
Workflows hum, tokens hop and play—
Publish and Sync on their bright way. 🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: replacing a shared CI bot with dedicated, minimally scoped GitHub Apps for release and sync-docs workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/scope-down-release-app-tokens

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/sync-docs.yml:
- Around line 14-15: The workflow currently sets permissions: contents: read
which prevents the "Commit and push docs back to CLI repo" step from pushing via
GITHUB_TOKEN; update the workflow permissions to grant write access (change or
replace contents: read with contents: write) so the checkout/push step can
authenticate and push release updates, and ensure any job-level or step-level
permissions do not override this change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5fab3ab6-4c0e-49a3-b16c-957839a79e11

📥 Commits

Reviewing files that changed from the base of the PR and between 6e57df9 and 73f779c.

📒 Files selected for processing (2)

• .github/workflows/publish.yml
• .github/workflows/sync-docs.yml

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

contents: read will cause the CLI-repo git push to fail on releases.

The "Commit and push docs back to CLI repo" step (line 61) writes back to the CLI repo via GITHUB_TOKEN (the initial actions/checkout@v4 at line 17 uses no explicit token). With only contents: read, that push will always get a 403 on non-draft release events.

The PR notes acknowledge this gap ("a step that writes docs may require contents: write"). The fix is straightforward:

🔒 Proposed fix

     permissions:
-      contents: read
+      contents: write

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/sync-docs.yml around lines 14 - 15, The workflow currently
sets permissions: contents: read which prevents the "Commit and push docs back
to CLI repo" step from pushing via GITHUB_TOKEN; update the workflow permissions
to grant write access (change or replace contents: read with contents: write) so
the checkout/push step can authenticate and push release updates, and ensure any
job-level or step-level permissions do not override this change.