[OPS-1301] Use baton-ci app token in capabilities_and_config.yaml

[ennyjfrick]

Replace the long-lived RELENG_GITHUB_TOKEN PAT with a short-lived baton-ci app token scoped to the current repo.

Mirrors the OPS-1300 templated workflow pattern. With the Connector Rules ruleset hardened, the legacy PAT only continues to work because of the temp org-admin mitigation; this PR replaces it with the proper App-token bypass actor before that mitigation is removed.

Linear: OPS-1301

🤖 Generated with Claude Code

[linear]

OPS-1301 Replace RELENG_GITHUB_TOKEN in legacy untemplated capabilities workflows

[github-actions]

Claude finished @ennyjfrick's task in 45s —— View job

---

PR Review: [OPS-1301] Use baton-ci app token in capabilities_and_config.yaml

• Gather context and read changed files
• Review the changes
• Post review feedback

---

LGTM — clean, minimal change that does exactly what it says.

What changed

The workflow replaces the long-lived RELENG_GITHUB_TOKEN PAT with a short-lived, repo-scoped token minted via the baton-ci GitHub App (actions/create-github-app-token@v2). The minted token is used for actions/checkout, and since checkout persists credentials, the downstream EndBug/add-and-commit step will inherit it for push operations. This is the correct pattern.

Review

Token scoping — The token is properly scoped to owner + the current repository name via github.event.repository.name. This is the minimum scope needed for checkout + commit-and-push. Looks good.

Step ordering — The token mint step is placed before checkout, which is correct since the checkout step depends on the token output.

Action version — actions/create-github-app-token@v2 is the current stable version. Consider pinning to a full SHA for supply-chain hardening (e.g., actions/create-github-app-token@<sha>), though this is a minor nit and may not match the repo's conventions.

Note

RELENG_GITHUB_TOKEN is still referenced in two other workflows:

• .github/workflows/verify.yaml
• .github/workflows/release.yaml

These are presumably tracked under separate tickets (OPS-1300 templated workflow pattern), but worth confirming they're on the migration roadmap.

No issues found — this is ready to merge.

[ennyjfrick]

Closing — generate-baton-metadata.yaml already exists in this repo (the modern baton-admin-managed equivalent), so this legacy capabilities_and_config.yaml is a duplicate and should be deleted instead. Replacing with a deletion PR.