fix(standards-sync-stuck-automerge-alert): author the tracking issue as the App, not the ambient token

[kyle-sexton]

No related issue: design amendment to merged #213 (runner-policy contract conflict)

Related

#210, #213, melodic-software/standards components/runner-policy

Summary

• The reusable already mints a read-only App token to scan every standards-sync target repo for stuck armed pull requests, but it still opens/updates/closes its own tracking issue with the ambient GITHUB_TOKEN, authored as github-actions[bot].
• That only works if the CALLING job explicitly grants issues: write (cross-org reusable workflows cannot elevate their own ambient-token scope beyond what the caller's job permissions declare — GitHub's own reusable-workflow calling example shows permissions: set on the job with uses:, and this repo's own runner-policy precedent for link-check.yml/pulumi-version-drift-check.yml already encodes the same requirement for their issue-writing behavior).
• Granting issues: write triggers runner-policy's invariant that a contract with allowedCallerPermissions must map every allowedSecrets entry as an exact identity passthrough ${{ secrets.<name> }}, where <name> must be a valid, non-hyphenated identifier. This reusable's own workflow_call.secrets inputs are app-client-id / app-private-key — kebab-case, so no mapping can ever satisfy that invariant. A caller adopting this reusable for its issue-writing behavior is permanently blocked by runner-policy, independent of which secret names it picks.
• Rejected alternative: relax runner-policy's write-caller-permissions invariant to allow non-identity secret mappings. Declined — that invariant is a deliberate defense-in-depth boundary (don't let a write-permission grant hide behind an opaque secret remap), and weakening it is a security-relevant call for the standards owner, not something to do as a side effect of unblocking one caller.

Change

• Mint a second, narrowly-scoped App token (permission-issues: write, owner/repositories omitted so it defaults to the calling repository only — verified against create-github-app-token's own input docs) and use it for all three issue-management steps (find/adopt, open-or-update, close).
• Update ISSUE_AUTHOR_LOGIN from github-actions[bot] to melodic-standards-sync[bot] — empirically verified via gh api users/melodic-standards-sync%5Bbot%5D (login: "melodic-standards-sync[bot]", type: "Bot").
• Drop the job's own issues: write permission — no ambient-token issue write remains, so it isn't needed.
• This is stronger decoy resistance than before, not just a policy workaround: github-actions[bot] is the shared identity of every ambient-token workflow in a repo, so any other workflow with issues: write could theoretically author a decoy tracking issue. The App's identity is exclusive to this workflow's own token mint.
• Result: the reusable's workflow_call inputs/secrets contract is unchanged, but a caller no longer needs to grant issues: write at all — its runner-policy contract entry can be secrets-only, with no allowedCallerPermissions waiver.

Test plan

• actionlint .github/workflows/standards-sync-stuck-automerge-alert.yml — clean
• zizmor .github/workflows/standards-sync-stuck-automerge-alert.yml — no findings
• CI (this PR's own checks)
• Manual verification once melodic-standards-sync App gets its Issues: read+write grant (tracked separately as an operator action) — first live scheduled run in a caller repo confirms the tracking issue is authored by melodic-standards-sync[bot]

🤖 Generated with Claude Code

https://claude.ai/code/session_01KYvF6bWGqemS9aYFfWJRiW

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/ci-workflows/actions/runs/29957720804
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":375,"total_cost_usd":0}

Re-running the job, or pushing a new commit, will retry the review.

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/ci-workflows/actions/runs/29957720879
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":400,"total_cost_usd":0}

Re-running the job, or pushing a new commit, will retry the review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c18c0ef64d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".