From ad9cd9a795a0292ad6b33053a8ac2b3053b05911 Mon Sep 17 00:00:00 2001
From: jan-kubica <jankubica@protonmail.com>
Date: Fri, 14 Aug 2026 10:46:13 +0200
Subject: [PATCH] fix: use supported GitHub App client input

---
 .github/workflows/changeset-release-pr.test.mjs | 12 ++++++++++++
 .github/workflows/changeset-release-pr.yml      |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/changeset-release-pr.test.mjs b/.github/workflows/changeset-release-pr.test.mjs
index 47bb152..8e6a9d8 100644
--- a/.github/workflows/changeset-release-pr.test.mjs
+++ b/.github/workflows/changeset-release-pr.test.mjs
@@ -58,6 +58,18 @@ test("tool installation precedes the write-capable release credential", () => {
   assert.ok(preparation < token);
 });
 
+test("GitHub App tokens use the supported client-id input", () => {
+  assert.match(
+    workflow,
+    /uses: actions\/create-github-app-token@[0-9a-f]{40} # v3\.2\.0/,
+  );
+  assert.match(
+    workflow,
+    /client-id: \$\{\{ secrets\.CHANGELOG_APP_ID \}\}/,
+  );
+  assert.doesNotMatch(workflow, /^\s+app-id:/m);
+});
+
 test("stale source revisions cannot mint credentials or mutate release PRs", () => {
   const freshness = indexOf("name: Check release source is current");
   const token = indexOf("name: Mint version PR token");
diff --git a/.github/workflows/changeset-release-pr.yml b/.github/workflows/changeset-release-pr.yml
index 4eff80b..4619812 100644
--- a/.github/workflows/changeset-release-pr.yml
+++ b/.github/workflows/changeset-release-pr.yml
@@ -164,7 +164,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ secrets.CHANGELOG_APP_ID }}
+          client-id: ${{ secrets.CHANGELOG_APP_ID }}
           private-key: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}