From 73f779c2a3833bbac13977b6f56b78219a6c2129 Mon Sep 17 00:00:00 2001
From: Rafal Rabenda <rafal@genlayerlabs.com>
Date: Wed, 6 May 2026 12:24:37 +0200
Subject: [PATCH 1/2] ci: scope down release/sync-docs to dedicated GitHub Apps

Replace the over-privileged shared CI bot with two dedicated, minimally
scoped GitHub Apps gated behind protected environments.

- publish.yml: rename environment npm -> Publish, switch from
  tibdex/github-app-token@v2 (archived) to actions/create-github-app-token@v3
  with vars.PUBLISH_CI_APP_CLIENT_ID + secrets.PUBLISH_CI_APP_KEY.
- sync-docs.yml (renamed from cli-docs.yml for cross-repo consistency
  with genlayer-testing-suite): bump create-github-app-token to @v3,
  switch to client-id, gate behind the Sync-docs environment with
  vars.DOCS_SYNC_APP_CLIENT_ID + secrets.DOCS_SYNC_APP_KEY.

Each App should be installed only on the repos it needs (Publish: this
repo only; Sync-docs: this repo + genlayer-docs) with Contents: read
& write as the only permission.
---
 .github/workflows/publish.yml                     | 8 ++++----
 .github/workflows/{cli-docs.yml => sync-docs.yml} | 5 +++--
 2 files changed, 7 insertions(+), 6 deletions(-)
 rename .github/workflows/{cli-docs.yml => sync-docs.yml} (96%)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3836570d..175b5d83 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,14 +16,14 @@ permissions:
 jobs:
   release:
     runs-on: ubuntu-latest
-    environment: npm
+    environment: Publish
     steps:
       - name: Get CI Bot Token
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: ci_bot_token
         with:
-          app_id: ${{ secrets.CI_BOT_APP_ID }}
-          private_key: ${{ secrets.CI_BOT_SECRET }}
+          client-id: ${{ vars.PUBLISH_CI_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUBLISH_CI_APP_KEY }}
 
       - name: Checkout source code
         uses: actions/checkout@v4
diff --git a/.github/workflows/cli-docs.yml b/.github/workflows/sync-docs.yml
similarity index 96%
rename from .github/workflows/cli-docs.yml
rename to .github/workflows/sync-docs.yml
index 54f72166..335376b1 100644
--- a/.github/workflows/cli-docs.yml
+++ b/.github/workflows/sync-docs.yml
@@ -10,6 +10,7 @@ jobs:
     # Skip for pre-releases (tags containing '-') unless manually dispatched
     if: github.event_name != 'release' || !contains(github.event.release.tag_name, '-')
     runs-on: ubuntu-latest
+    environment: Sync-docs
     permissions:
       contents: read
     steps:
@@ -64,9 +65,9 @@ jobs:
 
       - name: Generate docs repo token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.DOCS_SYNC_APP_ID }}
+          client-id: ${{ vars.DOCS_SYNC_APP_CLIENT_ID }}
           private-key: ${{ secrets.DOCS_SYNC_APP_KEY }}
           repositories: genlayer-docs
 

From 690c5775b312415a30e38ecb51cc3b7b688801c5 Mon Sep 17 00:00:00 2001
From: Edgars <edgars@genlayerlabs.com>
Date: Wed, 6 May 2026 13:58:34 +0100
Subject: [PATCH 2/2] ci: use App token for CLI self-push, fix detached HEAD

- Mint Sync-docs App token before CLI checkout, scope to both
  genlayer-cli and genlayer-docs.
- Use App token for the initial CLI checkout so the docs-back-to-main
  push is authed as the App (which is on the main bypass list),
  not as github-actions[bot].
- Push as `origin HEAD:main` so release-tag triggered runs (detached
  HEAD) can find a target ref.
---
 .github/workflows/sync-docs.yml | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml
index 335376b1..854bb66f 100644
--- a/.github/workflows/sync-docs.yml
+++ b/.github/workflows/sync-docs.yml
@@ -14,8 +14,18 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.DOCS_SYNC_APP_CLIENT_ID }}
+          private-key: ${{ secrets.DOCS_SYNC_APP_KEY }}
+          repositories: genlayer-cli,genlayer-docs
+
       - name: Checkout CLI repo
         uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -58,19 +68,11 @@ jobs:
             git add docs/api-references
             VERSION=${{ steps.version.outputs.value }}
             git commit -m "docs(cli): update API reference for ${VERSION}"
-            git push
+            git push origin HEAD:main
           else
             echo "No docs changes to commit"
           fi
 
-      - name: Generate docs repo token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          client-id: ${{ vars.DOCS_SYNC_APP_CLIENT_ID }}
-          private-key: ${{ secrets.DOCS_SYNC_APP_KEY }}
-          repositories: genlayer-docs
-
       - name: Checkout docs repo
         uses: actions/checkout@v4
         with: