Adopt GitHub App Authentication

[Muiris Woulfe (muiriswoulfe)]

Purpose

Replace long-lived GitHub PAT authentication with short-lived GitHub App installation tokens backed by Azure Key Vault.

Impact

GitHub automation now uses scoped, temporary credentials across GitHub Actions and Azure Pipelines, reducing credential exposure and aligning Omex with the established PR Metrics design.

[Copilot]

Pull request overview

This PR replaces long-lived GitHub PAT usage in automation with short-lived GitHub App installation tokens minted via Azure Key Vault, aligning GitHub Actions and Azure Pipelines with scoped, temporary credentials.

Changes:

• Updated the package-update GitHub Actions workflow to mint and use a GitHub App installation token via a new composite action.
• Updated the Azure Pipelines “GitHub forward” pipeline to fetch from GitHub using a minted GitHub App token rather than a PAT.
• Extended Dependabot configuration to include the new action directory.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/package-update.yml	Switches workflow authentication to a minted GitHub App token (OIDC → Key Vault → installation token).
.github/pipelines/github-forward.yml	Replaces PAT-based git fetch with GitHub App token-based authentication in ADO.
.github/dependabot.yml	Adds Dependabot coverage for the new composite action directory.
.github/actions/mint-github-app-token/New-GitHubAppToken.ps1	Introduces the PowerShell implementation that mints installation tokens using a Key Vault-stored private key.
.github/actions/mint-github-app-token/action.yml	Adds a composite action wrapper around Azure login + token minting script.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/package-update.yml:31

• The minted installation token is granted issues:write, but this workflow only pushes a branch and creates a PR (gh pr create). Dropping unused permissions reduces blast radius if the token is leaked.

      - name: App Token – Mint
        id: app-token
        uses: ./.github/actions/mint-github-app-token
        with:
          azure-client-id: ${{ vars.AZURE_CLIENT_ID }}
          azure-tenant-id: ${{ vars.AZURE_TENANT_ID }}
          azure-subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
          permissions: '{"contents":"write","issues":"write","pull_requests":"write"}'

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[Muiris Woulfe (muiriswoulfe)]

Replaced by #879, which uses a branch hosted directly in microsoft/Omex.