Refactor sync workflow to use Github App

[pdabelf5]

Proposed changes

This pull request updates the GitHub Actions workflows to improve security and modernize authentication for repository automation. The main changes involve removing the legacy Dependabot auto-merge workflow and refactoring the sync.yml workflow to use GitHub App tokens fetched from a vault, instead of personal access tokens.

Workflow deprecation:

• Removed the .github/workflows/dependabot-auto-merge.yml workflow, discontinuing automatic merging of Dependabot PRs.

Authentication and security improvements:

• Updated the sync.yml workflow to fetch GitHub App credentials from a vault using the get-from-vault action, and mint short-lived GitHub App tokens for each organization and repository, replacing the use of static personal access tokens.
• Added explicit id-token: write and contents: read permissions for jobs, following GitHub Actions security best practices.

Repository sync and label management updates:

• Refactored the label sync step to use the new GitHub App tokens and updated repository references from nginxinc to nginx where appropriate.
• Split repository sync steps to use the appropriate minted token for each organization, ensuring least-privilege access.

Checklist

Before creating a PR, run through this checklist and mark each as complete:

• I have read the contributing guidelines.
• I have signed the F5 Contributor License Agreement (CLA).
• If applicable, I have added tests that prove my fix is effective or that my feature works.
• If applicable, I have checked that any relevant tests pass after adding my changes.
• I have updated any relevant documentation (README.md and/or CHANGELOG.md).

[Copilot]

🟡 Changes recommended

The App private key remains exposed to subsequent actions and subprocesses after token minting.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Refactors repository automation to use short-lived GitHub App tokens and removes Dependabot auto-merge.

Changes:

• Retrieves GitHub App credentials from Azure Key Vault.
• Mints organization-scoped tokens for label and repository synchronization.
• Removes the Dependabot auto-merge workflow.

File summaries

File	Description
.github/workflows/sync.yml	Migrates synchronization from PATs to GitHub App tokens.
.github/workflows/dependabot-auto-merge.yml	Removes automated Dependabot merging.

Review details

Suppressed comments (1)

.github/workflows/sync.yml:101

• After all three installation tokens are minted, the long-lived App private key remains inherited by every gh subprocess even though they only need GH_TOKEN. Clear APP_PRIVATE_KEY before starting the sync commands to minimize exposure of a credential that can mint tokens beyond these repository-scoped tokens.

      - name: Sync nginx-bot/certified-operators

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.