[imanimanyara]

Summary

Retires simtabi-bot. refresh-bot becomes the single CI app, keeping the estate to two apps — simbi-github-cli for local gh/git, and this one for CI.

Which app survived was decided by measurement, not by which was newer (gh api apps/<slug> --jq .permissions, 2026-11-03):

refresh-bot   contents=write metadata=read pull_requests=write        (3)
simtabi-bot   + checks, issues, statuses, workflows=write             (7)

refresh-bot is the narrower app, and 35 workflow files across the estate already used it against 2 for simtabi-bot — so it is both the safer and the cheaper survivor. Retiring the other way round would have meant moving 35 files and widening a credential.

simtabi-bot was also effectively unused: gh api repos/simtabi/.github/actions/variables returns none, so SIMTABI_BOT_CLIENT_ID was never set, the merge gate skipped every run, and the reconciler had always fallen through to refresh-bot.

The ceiling is now the app's own permission set

That is the whole safety property. refresh-bot's key is an organisation-level secret on every owned org, so a ceiling wider than the app puts the extra reach within range of every workflow in the estate. workflows: write is the one that matters: with it, a release job could rewrite the CI that gates it.

policy.json, resolve.py and the bot-token action are app-agnostic — they take a client ID and a key as inputs — so only the credentials the two workflows pass changed, plus the ceiling.

dependabot-merge is left defined but inoperative

A permission, not a bug. merge.py reads commits/{sha}/check-runs and /status, which need checks: read and statuses: read; refresh-bot holds neither, so decide() sees no checks and refuses every pull request — fail-closed. Granting those two reads on the app, and each org approving them, is the owner's step.

Without workflows: write, a pull request touching .github/workflows/ can never be merged by this token. Those go to @dependabot merge, which Dependabot performs with its own credentials.

Verification

• 24 tests pass, up from 23.
• CeilingMatchesTheAppTest pins the ceiling to the app's permission set and refuses workflows, issues, administration, members and secrets by name. Proven red before being trusted: planting workflows: write in the ceiling fails 6 tests; reverting goes green.
• Both workflows parse (yaml.safe_load); jobs unchanged (accounts+merge, accounts+reconcile).
• grep over the repository: no SIMTABI_BOT_* reference remains outside deliberate history notes.

Still the owner's own steps

• Grant checks: read and statuses: read on refresh-bot, then approve per org, before the merge gate can run.
• Delete the simtabi-bot app, and remove this repository's simtabi-bot environment, which still holds its key. Nothing reads it now — but a key nobody reads is still a key nobody rotates.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.