chore(ci): use OpenCode app credentials for ci-fixer and model sync (#3887)

* chore(ci): use OpenCode app credentials for fixer PRs

Mint GitHub App tokens for ci-fixer and issue-fixer so opened PRs
trigger CI and can be auto-merged, matching the opencode repo pattern.

* chore(ci): app credentials for ci-fixer and model sync only

Keep issue-fixer on GITHUB_TOKEN. Use the OpenCode app for ci-fixer
and sync-models so their PRs trigger CI.

* fix(ci): keep GITHUB_TOKEN for sync issue creation

Missing-model issues must be opened with GITHUB_TOKEN so issues.opened
does not fire; Issue Fixer is started only via repository_dispatch.
Use the app token only when reporting/pushing catalog PRs.

.github/actions/setup-git-committer/action.yml

@@ -0,0 +1,43 @@
+name: "Setup Git Committer"
+description: "Create app token and configure git user"
+inputs:
+  opencode-app-id:
+    description: "OpenCode GitHub App ID"
+    required: true
+  opencode-app-secret:
+    description: "OpenCode GitHub App private key"
+    required: true
+outputs:
+  token:
+    description: "GitHub App token"
+    value: ${{ steps.apptoken.outputs.token }}
+  app-slug:
+    description: "GitHub App slug"
+    value: ${{ steps.apptoken.outputs.app-slug }}
+runs:
+  using: "composite"
+  steps:
+    - name: Create app token
+      id: apptoken
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+      with:
+        app-id: ${{ inputs.opencode-app-id }}
+        private-key: ${{ inputs.opencode-app-secret }}
+        owner: ${{ github.repository_owner }}
+
+    - name: Configure git user
+      run: |
+        slug="${{ steps.apptoken.outputs.app-slug }}"
+        git config --global user.name "${slug}[bot]"
+        git config --global user.email "${slug}[bot]@users.noreply.github.com"
+      shell: bash
+
+    - name: Clear checkout auth
+      run: |
+        git config --local --unset-all http.https://github.com/.extraheader || true
+      shell: bash
+
+    - name: Configure git remote
+      run: |
+        git remote set-url origin https://x-access-token:${{ steps.apptoken.outputs.token }}@github.com/${{ github.repository }}
+      shell: bash

.github/workflows/ci-fixer.yml

@@ -28,14 +28,23 @@ jobs:
     runs-on: ubuntu-latest
     env:
       GH_REPO: ${{ github.repository }}
-      GH_TOKEN: ${{ github.token }}
       FAILED_RUN_ID: ${{ github.event.workflow_run.id }}
       FAILED_RUN_URL: ${{ github.event.workflow_run.html_url }}
       FAILED_WORKFLOW: ${{ github.event.workflow_run.name }}
 
     steps:
+      - name: Create app token
+        id: apptoken
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+        with:
+          app-id: ${{ vars.OPENCODE_APP_ID }}
+          private-key: ${{ secrets.OPENCODE_APP_SECRET }}
+          owner: ${{ github.repository_owner }}
+
       - name: Check run budget
         id: budget
+        env:
+          GH_TOKEN: ${{ steps.apptoken.outputs.token }}
         run: |
           set -euo pipefail
 
@@ -92,6 +101,15 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: dev
+          persist-credentials: false
+
+      - name: Setup git committer
+        id: committer
+        if: steps.budget.outputs.run == 'true' && steps.budget-cache.outputs.cache-hit != 'true'
+        uses: ./.github/actions/setup-git-committer
+        with:
+          opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
+          opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
 
       - name: Install opencode
         if: steps.budget.outputs.run == 'true' && steps.budget-cache.outputs.cache-hit != 'true'
@@ -99,6 +117,8 @@ jobs:
 
       - name: Collect failed logs
         if: steps.budget.outputs.run == 'true' && steps.budget-cache.outputs.cache-hit != 'true'
+        env:
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
         run: |
           set -euo pipefail
           LOG_FILE="$RUNNER_TEMP/dev-ci-failure.log"
@@ -159,6 +179,7 @@ jobs:
       - name: Create pull request
         if: steps.budget.outputs.run == 'true' && steps.budget-cache.outputs.cache-hit != 'true'
         env:
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
           BRANCH: ci-fixer-${{ github.event.workflow_run.id || github.run_id }}
           TITLE: "fix: dev CI failure"
         run: |
@@ -169,8 +190,6 @@ jobs:
             exit 0
           fi
 
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git switch -c "$BRANCH"
           git add -A
           git commit -m "$TITLE"

.github/workflows/sync-models.yml

@@ -51,6 +51,14 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           ref: dev
+          persist-credentials: false
+
+      - name: Setup git committer
+        id: committer
+        uses: ./.github/actions/setup-git-committer
+        with:
+          opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
+          opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7
@@ -88,7 +96,7 @@ jobs:
 
       - name: Report changes
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
           BRANCH: automation/sync-models-${{ matrix.provider }}
           LABELS: automation,model-sync,provider:${{ matrix.provider }}
           TITLE: "chore(sync): update ${{ matrix.name }} model catalog"
@@ -107,8 +115,6 @@ jobs:
             exit 0
           fi
 
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git fetch --no-tags --depth=1 origin "+refs/heads/$BRANCH:refs/remotes/origin/$BRANCH" || true
           git checkout -B "$BRANCH"
           git add models providers