Migrate from deprecated 'app-id' to 'client-id' for GitHub App token

[ptr727]

Summary

actions/create-github-app-token deprecated the app-id input in v3.0.0 (2026-03-14) in favor of client-id. The template currently pins to v1.12.0 and uses the deprecated naming throughout. The secret name CODEGEN_APP_ID and the workflow input app-id: should both move to the CODEGEN_APP_CLIENT_ID / client-id: form so derived projects pick up the modern pattern.

The current action.yml on the action's main branch makes this explicit:

inputs:
  client-id:
    description: "GitHub App Client ID"
    required: false
  app-id:
    description: "GitHub App ID"
    required: false
    deprecationMessage: "Use 'client-id' instead."

Note that app-id (numeric App ID) and client-id (e.g. Iv23li...) are different identifiers — this is a secret-value migration, not just a rename. The App settings page exposes both; Client ID is the long-term identifier GitHub is steering Apps toward.

Files to update

1. Action pin

Bump actions/create-github-app-token@d72941d... # v1.12.0 to the latest stable (v3.2.0 at time of writing, SHA-pinned per the AGENTS.md "Action pinning" rule). Dependabot will keep it current after that.

2. Workflow files

• .github/workflows/merge-bot-pull-request.yml — three call sites (lines 82, 145, 198):
  • app-id: ${{ secrets.CODEGEN_APP_ID }} → client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
• .github/workflows/run-codegen-pull-request-task.yml — secret declaration (line 16) + call site (line 53):
  • CODEGEN_APP_ID: declaration → CODEGEN_APP_CLIENT_ID:
  • app-id: ${{ secrets.CODEGEN_APP_ID }} → client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}

3. README setup guidance

README.md line 452:

Save the App ID as `CODEGEN_APP_ID` and the private key contents as `CODEGEN_APP_PRIVATE_KEY` in both of:

Update to:

Save the App's Client ID as `CODEGEN_APP_CLIENT_ID` and the private key contents as `CODEGEN_APP_PRIVATE_KEY` in both of:

Plus a note on where to find Client ID in the App's settings page (it's labeled "Client ID" directly under the App name on the General tab), and explicitly call out that this is not the numeric App ID.

README.md line 468 — the parenthetical secret-list reference needs the same swap.

4. AGENTS.md and copilot-instructions.md

Neither file currently references the secret naming, but both should explicitly call out Client ID rather than App ID for any future App-related guidance added during sweeps. Worth a one-line note in AGENTS.md under the bot section so derived projects (and future contributors) don't reintroduce the deprecated naming.

Migration path for existing derived projects

Each derived repo must:

1. Grab the App's Client ID from the App settings page.
2. Add a new secret CODEGEN_APP_CLIENT_ID with that value in both Actions and Dependabot contexts.
3. Update workflow files to reference the new secret + input.
4. Delete the old CODEGEN_APP_ID secret.

The private key (CODEGEN_APP_PRIVATE_KEY) is unchanged.

Context

Discovered while migrating ptr727/NxWitness to the template's bot-PR / App-token model. NxWitness's pre-existing secret was already named CODEGEN_APP_CLIENT_ID (storing a Client ID value), which works fine with v1.12.0's app-id: input because GitHub's API accepts Client IDs there — but that's the deprecated path. New template adopters shouldn't be steered toward it.