From 4304dc7a655d32fd4f3abbd436c96bc77dbe6d6c Mon Sep 17 00:00:00 2001
From: Markus Frei <31855393+markuslf@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:59:56 +0200
Subject: [PATCH] ci: open upstream bump pull requests with the automation app
 token

---
 .github/workflows/lf-check-upstream.yml | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lf-check-upstream.yml b/.github/workflows/lf-check-upstream.yml
index 5175af1..1b1e123 100644
--- a/.github/workflows/lf-check-upstream.yml
+++ b/.github/workflows/lf-check-upstream.yml
@@ -22,15 +22,28 @@ jobs:
         with:
           egress-policy: 'audit'
 
+      # The bump pull requests are opened with the Linuxfabrik automation app
+      # instead of GITHUB_TOKEN. Pull requests authored by GITHUB_TOKEN do not
+      # get their checks run, so the required `dependency-review` check never
+      # reports and the pull request stays blocked forever.
+      - name: 'Generate app token'
+        id: 'app-token'
+        uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # v3.2.0
+        with:
+          client-id: '${{ vars.LF_AUTOMATION_CLIENT_ID }}'
+          private-key: '${{ secrets.LF_AUTOMATION_APP_PRIVATE_KEY }}'
+
       - name: 'git clone https://github.com/Linuxfabrik/packaging'
         uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
+        with:
+          token: '${{ steps.app-token.outputs.token }}'
 
       - name: 'Open a version-bump PR for every package behind its upstream'
         env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GITHUB_TOKEN: '${{ steps.app-token.outputs.token }}'
         run: |
-          git config user.name 'github-actions[bot]'
-          git config user.email 'github-actions[bot]@users.noreply.github.com'
+          git config user.name 'linuxfabrik-automation[bot]'
+          git config user.email 'linuxfabrik-automation[bot]@users.noreply.github.com'
 
           for dir in packages/*/; do
             name="$(basename "$dir")"