fix: use kernel-internal app token in update-cli-coverage workflow

[rgarcia]

Switch from GH_TOKEN PAT to kernel-internal GitHub App token so pushes and PRs trigger CI.

Changes

• Added step to generate app token from kernel-internal GitHub App (ADMIN_APP_ID, ADMIN_APP_PRIVATE_KEY)
• Replaced all secrets.GH_TOKEN references with steps.app-token.outputs.token
• Updated git identity to use kernel-internal[bot] name and proper bot email for commits
• All operations (gh CLI commands, repo clones) now use the app token

Why

Using a GitHub App token instead of a PAT ensures that:

1. Commits made by the workflow trigger CI workflows
2. PRs created by the workflow trigger CI workflows
3. Better security with scoped permissions

---

Note

Low Risk
Workflow-only authentication/identity changes; main risk is misconfigured app secrets/permissions causing the automation to fail to clone/push or open PRs.

Overview
Switches the update-cli-coverage workflow from using secrets.GH_TOKEN (PAT) to a generated GitHub App token (actions/create-github-app-token@v1 with ADMIN_APP_ID/ADMIN_APP_PRIVATE_KEY) for all gh operations (PR lookup, repo clones, and CLI update step).

Updates the workflow’s git author identity to kernel-internal[bot] so automated pushes/PRs are attributed to the app/bot (and can trigger downstream CI).

^{Written by Cursor Bugbot for commit f717f2d. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

• ✅ Fixed: App token missing cross-repo access scope
  • Added owner: kernel to the actions/create-github-app-token@v1 step so the generated token is scoped to all repos the app is installed on in the kernel organization, granting access to kernel/kernel and kernel/cli.

Or push these changes by commenting:

@cursor push 91bfe24f62

Preview (91bfe24f62)

diff --git a/.github/workflows/update-cli-coverage.yml b/.github/workflows/update-cli-coverage.yml
--- a/.github/workflows/update-cli-coverage.yml
+++ b/.github/workflows/update-cli-coverage.yml
@@ -26,6 +26,7 @@
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
+          owner: kernel
 
       - name: Get PR info for manual dispatch
         id: pr-info

[rgarcia]

@cursor push 91bfe24