From b7f71ba3fffe76820cded27aa71d6712c8258541 Mon Sep 17 00:00:00 2001
From: Abdurrahmaan Iqbal <abdurriq@github.com>
Date: Thu, 30 Jul 2026 12:34:29 +0000
Subject: [PATCH] Use GitHub App token instead of PAT in update-documentation
 workflow

---
 .github/workflows/update-documentation.yml | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/update-documentation.yml b/.github/workflows/update-documentation.yml
index 3cdfd283..6c4b9609 100644
--- a/.github/workflows/update-documentation.yml
+++ b/.github/workflows/update-documentation.yml
@@ -10,11 +10,19 @@ jobs:
     runs-on: ubuntu-latest
     environment: documentation
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     if: "github.ref == 'refs/heads/main'"
     steps:
+      - name: Generate a token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }}
+          private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }}
+
       - uses: actions/checkout@v5
+        with:
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Generate Documentation
         uses: devcontainers/action@v1
@@ -25,7 +33,7 @@ jobs:
       - name: Create a PR for Documentation
         id: push_image_info
         env:
-          GITHUB_TOKEN: ${{ secrets.PAT }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           set -e
           echo "Start."
@@ -51,7 +59,7 @@ jobs:
                 -H "Accept: application/vnd.github+json" \
                 /repos/${GITHUB_REPOSITORY}/pulls \
                 -f title="$message" \
-              -f body="$message" \
-              -f head="$branch" \
-              -f base='main'
-          fi
\ No newline at end of file
+                -f body="$message" \
+                -f head="$branch" \
+                -f base='main'
+          fi