ci(security): use default GITHUB_TOKEN for git push, not App token

[TalZaccai]

Problem

The fix-dependabot-alerts scheduled run is failing at git push with:

remote: Permission to microsoft/TypeChat.git denied to typeagent-bot[bot].
fatal: ... error: 403

Root cause confirmed via a diagnostic step on a temp branch:

=== Token permissions on microsoft/TypeChat ===
{"admin":false,"maintain":false,"pull":false,"push":false,"triage":false}

The workflow was using the GitHub App token for git push, which requires Contents: write at the App installation level. That's a permission the App didn't have (and shouldn't need to have — it has no business reading repo content for any other reason).

Fix

Match the microsoft/TypeAgent workflow pattern: keep persist-credentials: false on actions/checkout (so the token isn't reachable from untrusted npm install/build/test phases), but at the very end of the job — after all untrusted code has run — re-inject the workflow's own GITHUB_TOKEN, already scoped to contents: write via the workflow-level permissions: block, for the git push.

The App token is now used only where it must be:

• gh api dependabot/alerts (the default GITHUB_TOKEN can't reach this endpoint)
• gh pr create / labelling / closing superseded PRs (so the PR identity is the bot, not github-actions)

Verification

Manually triggered a workflow_dispatch run against a temp branch carrying this same patch — it passed git push and opened #360 with the legitimate minimatch patch. Logs: https://github.com/microsoft/TypeChat/actions/runs/26842937700

Cleanup follow-ups

• Temp diag branch dev/talzacc/diag-app-token will be deleted after this lands.
• fix: remediate Dependabot security alerts (2026-06-02) #360 (auto-created by the temp run) is a real Dependabot remediation and should be reviewed/merged on its own merits.

[Copilot]

Pull request overview

Updates the fix-dependabot-alerts workflow to push remediation branches using the workflow-scoped default GITHUB_TOKEN (with contents: write) instead of the GitHub App token, aligning with the intended permission model and avoiding push failures due to missing App installation permissions.

Changes:

• Adds a dedicated GIT_PUSH_TOKEN environment variable wired to the default GITHUB_TOKEN for authenticated git push.
• Keeps the GitHub App token (GH_TOKEN) for Dependabot alerts API access and gh pr create so PRs are authored under the bot identity.
• Switches the git remote set-url used for pushing to use GIT_PUSH_TOKEN rather than the App token.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.