[Innei]

Replaces the GH_TOKEN personal access token with an installation token minted by the LobeHub bot GitHub App, matching lobehub/lobehub and lobehub/lobe-ui.

Each job that read secrets.GH_TOKEN now starts with:

- uses: actions/create-github-app-token@v2
  id: app-token
  with:
    app-id: ${{ vars.LOBEHUB_BOT_APP_ID }}
    private-key: ${{ secrets.LOBEHUB_BOT_APP_PRIVATE_KEY }}

and uses ${{ steps.app-token.outputs.token }} where it used ${{ secrets.GH_TOKEN }}. LOBEHUB_BOT_APP_ID and LOBEHUB_BOT_APP_PRIVATE_KEY are org-level, so no repo setup is needed. The GH_TOKEN PAT is being revoked.

Changed:

• .github/workflows/issue-auto-comments.yml
• .github/workflows/issue-check-inactive.yml
• .github/workflows/issue-close-require.yml
• .github/workflows/release.yml

[lobe-tsukumo]

👍 @Innei

Thank you for raising your pull request and contributing to our Community.
Please make sure you have followed our contributing guidelines. We will review it as soon as possible.
If you encounter any problems, please feel free to connect with us.

非常感谢您提出拉取请求并为我们的社区做出贡献，请确保您已经遵循了我们的贡献指南，我们会尽快审查它。
如果您遇到任何问题，请随时与我们联系。

[vercel]

@Innei is attempting to deploy a commit to the LobeHub OSS Team on Vercel.

A member of the Team first needs to authorize it.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T08:56:27.425650Z	47d180e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 47d180ec8f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Mint the release App token after the build

When Install deps, CI, Test, and Build take at least an hour, the token created here has expired before the Release step uses it. GitHub documents that an installation access token "will expire after 1 hour", whereas the replaced PAT did not have this deadline, so a slow but otherwise successful release now fails during publishing; create or refresh the App token immediately before Release instead.

Useful? React with 👍 / 👎.