From 859b9bae85c25c058a012b713e66a955b1046187 Mon Sep 17 00:00:00 2001
From: Chris Farhood <chris@farhood.org>
Date: Mon, 4 May 2026 07:06:57 +0000
Subject: [PATCH] feat(workflows): add renovate-app-token reusable workflow for
 Mend Renovate

workflow_call reusable workflow that exposes a GitHub App installation
token. Mend Renovate will use this token to push commits.

Refs: PRI-413
---
 .github/workflows/renovate-app-token.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/workflows/renovate-app-token.yaml

diff --git a/.github/workflows/renovate-app-token.yaml b/.github/workflows/renovate-app-token.yaml
new file mode 100644
index 0000000..400d37c
--- /dev/null
+++ b/.github/workflows/renovate-app-token.yaml
@@ -0,0 +1,21 @@
+name: Mend Renovate GitHub App Token
+
+on:
+  workflow_call:
+    outputs:
+      token:
+        description: "Short-lived GitHub App installation token"
+        value: ${{ jobs.app-token.outputs.token }}
+
+jobs:
+  app-token:
+    runs-on: runners-privilegedescalation
+    outputs:
+      token: ${{ steps.app-token.outputs.token }}
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-- 
2.52.0