IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow

[alongosz]

Caution

• Drop TMP commits before merging

🎫 Issue	IBX-11778

Related PRs:

• IBX-11778: [GHA] Updated deprecated versions of GitHub actions gh-workflows#103
• IBX-11778: Added composite actions for metapackage Create Tag workflows gh-workflows#105
• IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow experience#604
• IBX-11778: Updated deprecated GitHub Actions in auto_tag workflow headless#286
• IBX-11778: Updated deprecated GitHub Actions in auto_tag and nightly workflows oss#285

Description:

Upgraded or replaced the GitHub Actions in the auto_tag.yml workflow that still run on the deprecated Node.js 20 runtime (to be removed from GitHub runners on September 16th, 2026):

• Replaced deprecated tibdex/github-app-token@v1 with actions/create-github-app-token@v3 (switching to client-id/private-key inputs; installation_id is no longer needed);
• Replaced octokit/request-action@v2.x usages with equivalent gh api calls, preserving the data output consumed by later steps;
• Upgraded actions/checkout to v7 and both jobs to the ubuntu-26.04 runner;
• Removed dead steps guarded by other editions' repository names (the file was designed to be copy-pasted between edition repositories, but the copies have since diverged anyway — including a stale content condition that can never match since the rename to headless), an always-true if, and the unused cs2pr tool;
• Fixed the Satis wait step: previously it could never fail (the for loop exit status masked the check result) and its final backoff sleep overran the 30-minute job timeout. It now re-checks on the 5-minute Satis cron cadence (30s/60s/120s ramp-up, then 5 × 300s), fails with an explicit error when the parent version never appears, and stays within the unchanged timeout. Also renamed the step to make clear it waits for the parent package ibexa/experience.
• Replaced the legacy EZROBOT_PAT (ezrobot personal access token) in the Commit, tag and push step with the GitHub App token the job already generates: the step authenticates git through gh auth setup-git with the token in its env — the credential flow stays local to the step and no secret is written into the remote URL / .git/config. The release commit is now authored as github-actions[bot], and inputs.version is passed to the shell via the step env instead of raw workflow-expression interpolation.

All other workflows in this repository only call ibexa/gh-workflows/...@main reusable workflows (deliberately trunk-tracking, already covered by ibexa/gh-workflows#103) and required no changes.

Update: the workflow has since been refactored on this branch to use the shared composite actions from ibexa/gh-workflows#105 (check-composer-package + create-metapackage-tag) — the file now keeps only edition-specific data. The preparation check now queries the Composer repository (Packagist/Satis) that composer update actually consumes, instead of probing for a GitHub tag. A [TMP] commit points the action references at the gh-workflows feature branch for testing; it must be dropped before merging.

For QA:

No manual QA required. The workflow can be validated by dispatching Create Tag with real_op: false (dry run — no tag is pushed) once a suitable release.json exists in ibexa/release-maker.

Before merging: the Commit, tag and push path only runs with real_op: true, so PR CI does not exercise it — verify the automation GitHub App has contents write permission and any tag protection allowances previously granted to the ezrobot account.

Documentation:

No documentation required.