ci: switches to dedicated identity for promotion PRs

[Vincent Biret (baywet)]

follow up to #7935 and #7974, depends on https://github.com/microsoft/github-operations/issues/1769

[Copilot]

🟡 Changes recommended

The workflow retains unnecessary GITHUB_TOKEN write access and does not explicitly restrict the App token’s permissions.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Switches shipped-API promotion automation from GITHUB_TOKEN to a dedicated GitHub App identity.

Changes:

• Generates an App token for checkout and pull request operations.
• Updates Git and GitHub CLI authentication.
• Persists the App token for automated Git operations.

File summaries

File	Description
.github/workflows/promote-shipped-apis.yml	Uses the dedicated identity throughout the promotion workflow; App token permissions must be narrowed, and redundant write permissions for GITHUB_TOKEN removed.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 9868e189ca60
Model: gpt-5.6-sol-fast

Overview

This change replaces the workflow's default GITHUB_TOKEN with a SHA-pinned GitHub App token and consistently passes it to checkout and GitHub CLI operations, while preserving the existing change detection, concurrency, and force-with-lease guards. The workflow is limited to pushes on main and manual dispatches, and the checked-out repository already retains the same token for later Git operations. The remaining concerns are credential-hygiene improvements or depend on unverified external configuration, so none establishes a publishable Critical, High, or Medium defect.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[Copilot]

🟡 Changes recommended

Promotion commit attribution should use the dedicated App slug and bot user ID.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

.github/workflows/promote-shipped-apis.yml:43

• actions/checkout already persists the supplied App token for subsequent fetch/push operations. Writing it into a global insteadOf URL unnecessarily leaves the secret readable in the runner's global Git configuration (and the URL places the token in the username position rather than the documented password position). Remove this rewrite and its step-scoped token environment.

          git config --global url."https://$($env:GH_TOKEN)@github.com/".insteadOf "https://github.com/"

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟢 Approval recommended

The reviewed workflow changes have no unresolved approval-blocking issues.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Balanced