Use client-id in CD's GitHub App token step

[gtbuchanan]

Summary

app-id is deprecated in actions/create-github-app-token, so every CD / Version run gets annotated with Input 'app-id' has been deprecated with message: Use 'client-id' instead. This renames the input.

The rename is input-only — no reprovisioning for this repo or for any consumer of the reusable workflow:

• The action reads core.getInput("client-id") || core.getInput("app-id") with no format validation.
• The value becomes the JWT iss claim, which GitHub documents as "the client ID or application ID of your GitHub App." Client ID is recommended, not required, and App ID is not deprecated on GitHub's side.

So the existing APP_ID repository variable flows straight through, and the setup requirements in README.md stay accurate.

⚠️ Do not merge until actionlint is updated

actionlint validates action inputs against a popular-actions database baked in at its release. The current snapshot predates create-github-app-token v3.1.0 (which added client-id), so it reads a correct cd.yml as both missing a required input and using an unknown one:

.github/workflows/cd.yml:54:15: missing input "app-id" which is required by action "actions/create-github-app-token@v3"
.github/workflows/cd.yml:58:11: input "client-id" is not defined in action "actions/create-github-app-token@v3"

This is the linter being stale, not the workflow being wrong — the v3 tag's own action.yml declares client-id, with app-id optional and carrying the deprecationMessage. No actionlint release available today refreshes that entry, so there is no version bump that fixes it.

.github/actionlint.yaml ignores those two messages for cd.yml purely to keep this branch green. Once an actionlint release refreshes that database entry, drop .github/actionlint.yaml and its AGENTS.md tree line, then merge just the one-line input rename — that way the suppression never lands on main.

Verification

mise run hk:all passes clean.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: febb1f8a-97da-4111-8993-f26d513c54da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}