ci: AUT-1408 replace cicd PAT with GitHub App tokens

[svcnemo-autobot]

Background

cicd-main used the long-lived secrets.PAT credential to publish fake coverage statuses.

What changed

Mint a short-lived GitHub App token from vars.BOT_ID and secrets.BOT_KEY, then pass it to actions/github-script.

Details

flowchart LR
  ID[BOT_ID] --> Token[Mint app token]
  Key[BOT_KEY] --> Token
  Token --> Coverage[Publish coverage status]

Loading

The token action is pinned to immutable v3.2.0.

Tested

• pre-commit run --all-files --show-diff-on-failure --color=never
• Workflow YAML parsing and token-order assertions
• Verified 1 token step and zero secrets.PAT references
• git diff --check

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[greptile-apps]

Greptile Summary

Replaces the long-lived PAT used to publish skipped-coverage statuses with a short-lived GitHub App installation token.

• Adds an immutable-pinned actions/create-github-app-token step using BOT_ID and BOT_KEY.
• Passes the generated token to actions/github-script while preserving the existing status target and payload.

Confidence Score: 5/5

The PR appears safe to merge, with the generated token targeting the same repository and commit-status operation as the credential it replaces.

The workflow preserves the existing status publication call and introduces the token-generation step before its only consumer; no concrete reachable failure or repository-rule violation was identified.

Important Files Changed

Filename	Overview
.github/workflows/cicd-main.yml	Replaces the PAT supplied to the fake-coverage status step with a short-lived GitHub App token scoped to the current repository; no actionable defect was established.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    BotId[vars.BOT_ID] --> Mint[Create GitHub App token]
    BotKey[secrets.BOT_KEY] --> Mint
    Mint --> Script[GitHub Script]
    Script --> Status[Publish codecov/patch status]

Loading

_{Reviews (1): Last reviewed commit: "ci: AUT-1408 replace cicd PAT with GitHu..." | Re-trigger Greptile}

[svcnvidia-nemo-ci]

/ok to test 262c762