Feat: route-sync uses a GitHub App token for fetch + CI-triggering PR

A single App credential covers both halves: read the private backend manifest
and open a PR here that actually triggers CI (default GITHUB_TOKEN PRs don't run
checks, so the drift guard would never go red). Mint the installation token
in-workflow via actions/create-github-app-token scoped to both repos; job
no-ops until SYNC_APP_ID + SYNC_APP_PRIVATE_KEY are set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jlsajfj

.github/workflows/route-sync.yml

@@ -1,41 +1,56 @@
 name: Route Sync
 
 # Opens a PR when the backend's canonical v2 route manifest drifts from the
-# vendored copy; the PR then fails test_route_coverage until the matching SDK
-# methods + `# v2:covers` comments are added. demo2 is private, so fetching its
-# manifest needs a token with Contents:read on it — store it as the
-# BACKEND_REPO_TOKEN secret (fine-grained PAT scoped to demo2, or a GitHub App
-# installation token).
+# vendored copy; that PR fails test_route_coverage until the matching SDK
+# methods + `# v2:covers` comments are added.
+#
+# Auth: a GitHub App is the single credential for both halves — it reads the
+# private backend repo's manifest AND opens a PR here that triggers CI (PRs from
+# the default GITHUB_TOKEN do not run checks). Configure:
+#   - var SYNC_APP_ID, secret SYNC_APP_PRIVATE_KEY
+#   - install the App on the backend repo (Contents: read) and on this repo
+#     (Contents: read/write, Pull requests: read/write)
+# Until configured the job no-ops.
 
 on:
   schedule:
     - cron: "0 12 * * *"
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   sync:
     runs-on: ubuntu-latest
     env:
-      GH_TOKEN: ${{ secrets.BACKEND_REPO_TOKEN }}
-      BACKEND_REPO: ${{ vars.BACKEND_REPO || 'TextQLLabs/demo2' }}
+      BACKEND_REPO_NAME: ${{ vars.BACKEND_REPO_NAME || 'demo2' }}
       MANIFEST_PATH: ${{ vars.BACKEND_MANIFEST_PATH || 'compute/pkg/platform/v2/routes.manifest.json' }}
       MANIFEST_REF: ${{ vars.BACKEND_MANIFEST_REF || 'main' }}
     steps:
       - uses: actions/checkout@v4
+      - name: Mint App token
+        id: app-token
+        if: ${{ vars.SYNC_APP_ID != '' }}
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.SYNC_APP_ID }}
+          private-key: ${{ secrets.SYNC_APP_PRIVATE_KEY }}
+          repositories: |
+            ${{ vars.BACKEND_REPO_NAME || 'demo2' }}
+            ${{ github.event.repository.name }}
       - name: Fetch upstream manifest
         id: fetch
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "BACKEND_REPO_TOKEN not set; skipping"
+            echo "GitHub App not configured (set SYNC_APP_ID + SYNC_APP_PRIVATE_KEY); skipping"
             echo "changed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          gh api "repos/${BACKEND_REPO}/contents/${MANIFEST_PATH}?ref=${MANIFEST_REF}" \
+          gh api "repos/${{ github.repository_owner }}/${BACKEND_REPO_NAME}/contents/${MANIFEST_PATH}?ref=${MANIFEST_REF}" \
             -H "Accept: application/vnd.github.raw" > upstream.json
           changed=$(python3 -c "import json; a=set(json.load(open('upstream.json'))); b=set(json.load(open('tests/routes.manifest.json'))); print('true' if a!=b else 'false')")
           if [ "$changed" = "true" ]; then cp upstream.json tests/routes.manifest.json; fi
@@ -44,9 +59,7 @@ jobs:
         if: steps.fetch.outputs.changed == 'true'
         uses: peter-evans/create-pull-request@v6
         with:
-          # Default GITHUB_TOKEN-created PRs do NOT trigger CI; pass a PAT/App
-          # token here if you want test_route_coverage to run automatically.
-          token: ${{ secrets.ROUTE_SYNC_PR_TOKEN || secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           branch: route-sync
           add-paths: tests/routes.manifest.json
           commit-message: "chore: sync v2 route manifest from backend"