ci(socket-fix): use GITHUB_TOKEN instead of an app private key

[devin-ai-integration]

Summary

This job runs @socketsecurity/cli fix --autopilot — third-party code, resolved at run time — in the same job that held a GitHub App private key. Worse, the key was GH_REPO_ACCESS_*, the enterprise app installed across keycardlabs, so that job could mint a token for every private labs repo.

It doesn't need an app at all: it only pushes a branch and opens a PR in its own repo, which GITHUB_TOKEN can do with the contents: write + pull-requests: write permissions the workflow already declares (no ruleset bypass is needed to open a PR).

-      - name: Generate GitHub App token
-        id: generate-token
-        uses: actions/create-github-app-token@v2
-        with:
-          app-id: ${{ secrets.GH_REPO_ACCESS_APP_ID }}
-          private-key: ${{ secrets.GH_REPO_ACCESS_PRIVATE_KEY }}
-
       - uses: actions/checkout@v4
-        with:
-          token: ${{ steps.generate-token.outputs.token }}
...
-          SOCKET_CLI_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+          SOCKET_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

GITHUB_TOKEN is scoped to this repository and cannot leave it, so there is no longer any credential here that reaches another repo, let alone another org. Deliberately not switched to the new SDK_RELEASE_* app: keeping a key out of the autopilot job is the point.

One behavior change to be aware of: PRs opened by GITHUB_TOKEN do not trigger workflow runs, so Socket's fix PRs will land without CI. If that matters, the alternative is a workflow_dispatch/workflow_run chain rather than putting a key back in this job.

Part of the GitHub Actions cross-org audit (keycardlabs <-> keycardai): finding F1.

Link to Devin session: https://app.devin.ai/sessions/6197211c97f643b09c1e0ace7b92d29f
Requested by: @kiambogo

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring