Use client-id in CD's GitHub App token step

.changeset/app-token-client-id.md

@@ -0,0 +1,4 @@
+---
+---
+
+Use `client-id` instead of the deprecated `app-id` input in CD's app-token step

.github/actionlint.yaml

@@ -0,0 +1,11 @@
+---
+# actionlint validates action inputs against a database of popular actions
+# baked in at its release. That snapshot predates create-github-app-token
+# v3.1.0, which added `client-id` and deprecated `app-id`, so it reads a
+# correct `cd.yml` as both missing a required input and using an unknown one.
+# Remove this file once an actionlint release refreshes that entry.
+paths:
+  .github/workflows/cd.yml:
+    ignore:
+      - 'input "client-id" is not defined in action'
+      - 'missing input "app-id" which is required'

.github/workflows/cd.yml

@@ -53,7 +53,9 @@ jobs:
       - id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.APP_ID }}
+          # Input rename only — `client-id` replaces the deprecated `app-id`,
+          # and the JWT `iss` claim it feeds accepts an App ID either way.
+          client-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       # `gtb version` needs node_modules (the local changeset bin + gtb itself).

AGENTS.md

@@ -13,6 +13,7 @@ mise.lock              — Per-platform binary checksums + download URLs
 mise.tasks.toml        — Generated by `gtb sync mise`; hk:all / hk:base tasks (loaded via mise.toml's task_config.includes)
 mise.toml              — Pin dev-tool versions for local + CI; postinstall hook installs hk
 .github/
+  actionlint.yaml              — Ignores for actionlint's stale popular-actions database
   actions/
     mise-setup/          — Composite action: install + cache mise tools
     pnpm-resolve-pinned/ — Composite action: resolve locked version without install