fix(workflow): bump create-github-app-token v2 → v3 (Node.js 24)

[BYK]

Summary

Bump actions/create-github-app-token from v2 to v3 across all workflow files to resolve the Node.js 20 deprecation warning.

Node.js 24 will be forced starting June 2, 2026. Node.js 20 removed from runners September 16, 2026.

Files changed

• publish.yml (was pinned to SHA @29824e69... with # v2 comment)
• ci-pending.yml (@v2.2.1)
• ci-poller.yml (@v2.2.1)
• auto-approve.yml (@v2.2.1)

Breaking changes in v3 (no impact)

• Proxy support now requires NODE_USE_ENV_PROXY=1 — not used in this repo
• Requires Actions Runner v2.327.1+ for self-hosted runners — N/A (GitHub-hosted)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 52727ee. Configure here.}

[cursor]

SHA-pinned action replaced with floating major tag

Low Severity

The create-github-app-token action in publish.yml was previously pinned to a specific commit SHA (@29824e69...), which protects against supply-chain attacks by ensuring the exact code is known and immutable. It's now changed to a floating major version tag (@v3), which can be moved to point to different code at any time. This workflow runs in the production environment and has access to many sensitive secrets (NPM tokens, Docker credentials, GPG keys, PyPI tokens, etc.), so the original SHA pinning was presumably a deliberate security measure. The other three workflow files were already using floating tags, but publish.yml has a significantly higher blast radius.

 

^{Reviewed by Cursor Bugbot for commit 52727ee. Configure here.}