[TT-17030] Replace ADMIN_PAT with GitHub App token in force-merge.yaml

[buger]

Summary

• Migrate force-merge reusable workflow from ADMIN_PAT (PAT) to GitHub App tokens
• Replace ADMIN_PAT secret with PROBE_APP_ID and PROBE_APP_PRIVATE_KEY
• Add actions/create-github-app-token step to generate a token before the merge step
• The generated token is used as github-token in actions/github-script for merge operations

Note

The GitHub App must have sufficient permissions (admin/bypass branch protection) for force-merge to work. Verify the app's installation permissions cover this use case.

Test plan

• Verify force-merge still works by commenting /force-merge <reason> on a test PR
• Verify Slack notifications are still sent after force-merge
• Verify non-admin users are still rejected

🤖 Generated with Claude Code

[probelabs]

This PR updates the force-merge.yaml reusable workflow to use a GitHub App token for authentication instead of a Personal Access Token (PAT). This enhances security by replacing the long-lived ADMIN_PAT with short-lived, dynamically generated tokens.

Files Changed Analysis

• .github/workflows/force-merge.yaml: Modified (+14, -3)
  • The on.workflow_call.secrets block was updated to remove ADMIN_PAT and add PROBE_APP_ID and PROBE_APP_PRIVATE_KEY.
  • A new step, "Generate GitHub App token," was added using the actions/create-github-app-token action to generate a temporary token.
  • The "Check and Merge Pull Request" step was updated to use the output token from the new step (${{ steps.app-token.outputs.token }}) for authentication with the github-script action.

Architecture & Impact Assessment

This change isolates the force-merge authentication mechanism to a dedicated GitHub App, improving security by moving away from a user-associated PAT. The core logic of the script remains unchanged, but the authentication method is modernized.

Affected Components:

• The force-merge.yaml reusable workflow.
• Any workflows that call this reusable workflow will need to be updated to provide the new GitHub App secrets instead of the old ADMIN_PAT.

Authentication Flow:

graph TD
    subgraph force_merge_yaml ["force-merge.yaml"]
        A[Start] --> B{Generate Token};
        B -- App ID & Private Key --> C[actions/create-github-app-token];
        C -- "Generates Short-Lived Token" --> D{Execute Merge Script};
        D -- "Uses Token" --> E[actions/github-script];
    end
    E -- "Authenticates with GitHub API" --> F[Merge PR];

Loading

Scope Discovery & Context Expansion

The direct impact is limited to this workflow file. However, the change has a wider blast radius, affecting all CI/CD pipelines that rely on this reusable workflow for force-merging. A codebase search for uses: ./.github/workflows/force-merge.yaml would be necessary to identify all caller workflows that require updates to their secret management to ensure they pass the new PROBE_APP_ID and PROBE_APP_PRIVATE_KEY secrets.

Metadata

• Review Effort: 2 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-04-22T16:24:50.060Z | Triggered by: pr_opened | Commit: 7a6e7ee

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/force-merge.yaml:25	The 'owner' parameter for generating the GitHub App token is hardcoded to 'TykTechnologies'. This reduces the reusability and portability of the workflow. If this workflow is ever used in a fork or a different repository, this step will fail or attempt to generate a token for the wrong owner. Using the `github.repository_owner` context variable makes the workflow more robust and correctly scoped to the repository where it is running. 💡 Suggestion Replace the hardcoded owner with the `github.repository_owner` context variable to ensure the token is generated for the correct repository owner dynamically. 🔧 Suggested Fix owner: ${{ github.repository_owner }}

Architecture Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/force-merge.yaml:25	The `owner` parameter for generating the GitHub App token is hard-coded to `TykTechnologies`. This limits the reusability of this workflow, as it will fail if used in a repository owned by a different user or organization (e.g., a fork). Using the `github.repository_owner` context variable would make this reusable workflow more portable and robust. 💡 Suggestion Replace the hard-coded owner `TykTechnologies` with the dynamic context variable `${{ github.repository_owner }}`. This ensures the token is always generated for the correct repository owner where the action is running. 🔧 Suggested Fix owner: ${{ github.repository_owner }}

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/force-merge.yaml:25	The 'owner' parameter for generating the GitHub App token is hardcoded to 'TykTechnologies'. This reduces the reusability and portability of the workflow. If this workflow is ever used in a fork or a different repository, this step will fail or attempt to generate a token for the wrong owner. Using the `github.repository_owner` context variable makes the workflow more robust and correctly scoped to the repository where it is running. 💡 Suggestion Replace the hardcoded owner with the `github.repository_owner` context variable to ensure the token is generated for the correct repository owner dynamically. 🔧 Suggested Fix owner: ${{ github.repository_owner }}

\n\n ### Architecture Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/force-merge.yaml:25	The `owner` parameter for generating the GitHub App token is hard-coded to `TykTechnologies`. This limits the reusability of this workflow, as it will fail if used in a repository owned by a different user or organization (e.g., a fork). Using the `github.repository_owner` context variable would make this reusable workflow more portable and robust. 💡 Suggestion Replace the hard-coded owner `TykTechnologies` with the dynamic context variable `${{ github.repository_owner }}`. This ensures the token is always generated for the correct repository owner where the action is running. 🔧 Suggested Fix owner: ${{ github.repository_owner }}

\n\n ### ✅ Performance Check Passed

No performance issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-04-22T16:24:25.065Z | Triggered by: pr_opened | Commit: 7a6e7ee

💡 TIP: You can chat with Visor using /visor ask <your question>