chore(ci): add automatic production deployer, re-scope github app

[dotkas]

No description provided.

[Copilot]

Pull request overview

This PR tightens the scope of the GitHub App token used in CI workflows and introduces a scheduled workflow that automatically opens (and auto-merges) a “develop → main” production PR when there are changes to ship.

Changes:

• Restrict actions/create-github-app-token to the current repository via repositories: ${{ github.event.repository.name }} across multiple workflows.
• Add a new scheduled/manual workflow to create a production PR from develop to main and enable auto-merge.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/update-deps-github-actions.yml	Scope the GitHub App token to the current repository.
.github/workflows/update-deps-cargo.yml	Scope the GitHub App token to the current repository.
.github/workflows/deploy.yml	Scope the GitHub App token to the current repository in the deploy workflow.
.github/workflows/check-openapi-versions.yml	Scope the GitHub App token to the current repository.
.github/workflows/automatic-prod-pr.yml	Add scheduled workflow to open/auto-merge a “develop → main” production PR.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (6)

.github/workflows/automatic-prod-pr.yml:74

• To keep merge behavior consistent with the other auto-merge workflow (which explicitly sets merge-method: squash), set the merge method here as well so the resulting history doesn’t depend on the action’s default.

        with:
          token: ${{ steps.app.outputs.token }}
          pull-request-number: ${{ steps.create_pr.outputs.pr_number }}

.github/workflows/update-deps-github-actions.yml:17

• github.event.repository.name is not set for schedule runs, so this can evaluate to an empty value and cause the app token to be unscoped or the step to fail. Derive the repository name from github.repository instead so it works for all event types.

          owner: ${{ github.repository_owner }}
          client-id: ${{ vars.HOUSEKEEPING_BOT_APP_ID }}
          repositories: ${{ github.event.repository.name }}
          private-key: ${{ secrets.HOUSEKEEPING_BOT_PRIVATE_KEY }}

.github/workflows/update-deps-cargo.yml:20

• github.event.repository.name is not set for schedule runs, so this can evaluate to an empty value and cause the app token to be unscoped or the step to fail. Derive the repository name from github.repository instead so it works for all event types.

          owner: ${{ github.repository_owner }}
          client-id: ${{ vars.HOUSEKEEPING_BOT_APP_ID }}
          repositories: ${{ github.event.repository.name }}
          private-key: ${{ secrets.HOUSEKEEPING_BOT_PRIVATE_KEY }}

.github/workflows/check-openapi-versions.yml:32

• github.event.repository.name is not set for schedule runs, so this can evaluate to an empty value and cause the app token to be unscoped or the step to fail. Derive the repository name from github.repository instead so it works for all event types.

        with:
          owner: ${{ github.repository_owner }}
          client-id: ${{ vars.HOUSEKEEPING_BOT_APP_ID }}
          repositories: ${{ github.event.repository.name }}
          private-key: ${{ secrets.HOUSEKEEPING_BOT_PRIVATE_KEY }}

.github/workflows/deploy.yml:44

• github.event.repository.name is not set for some event types (notably schedule), which can lead to an empty repository list and a broadly scoped or failing token. Using the repository name derived from github.repository is consistent and works across events.

          owner: ${{ github.repository_owner }}
          client-id: ${{ vars.HOUSEKEEPING_BOT_APP_ID }}
          repositories: ${{ github.event.repository.name }}
          private-key: ${{ secrets.HOUSEKEEPING_BOT_PRIVATE_KEY }}

.github/workflows/automatic-prod-pr.yml:22

• This workflow is triggered by schedule, where github.event.repository.name is not populated. That can make the GitHub App token creation step fail or produce an unexpectedly broad token. Compute the repo name from github.repository instead.

This issue also appears on line 72 of the same file.

          owner: ${{ github.repository_owner }}
          client-id: ${{ vars.HOUSEKEEPING_BOT_APP_ID }}
          repositories: ${{ github.event.repository.name }}
          private-key: ${{ secrets.HOUSEKEEPING_BOT_PRIVATE_KEY }}

[alchemax-housekeeper]

🎉 This PR is included in version 1.0.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀