Migrate tag_deploy* templates to the GitHub App token and sunset simp-auto (74 repos)

Goal

Retire the simp-auto user account as a credential holder, by migrating the three tag_deploy* templates off its PAT and onto the org-owned GitHub App.

Why this is urgent-ish

We no longer hold simp-auto's credentials. Regaining access would mean a password reset, which risks invalidating its PATs — and 74 repos currently carry a deployed workflow referencing SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE. That means the fleet's entire release path depends on a static token belonging to an account nobody can log into, last touched 2021-07.

Two concrete limitations already bit us while fixing fork syncing:

• The PAT cannot write .github/workflows/* (no workflow scope, and it predates the modern alternatives). 5 of 23 fork syncs failed on this.
• simp-auto is an org member, not an admin, so it cannot bypass branch protection anywhere in the org.

Scope: what still references the token

Template (this repo)	Deployed copies
modules/profile/files/pupmod/_github/workflows/tag_deploy.yml
modules/profile/files/_github/workflows/tag_deploy_github-rpms.yml
modules/profile/files/_github/workflows/tag_deploy_rubygem__github-rpms.yml
total repos carrying a reference	74

In each, the token is passed as github-token: to actions/github-script, which calls:

POST /repos/{owner}/{repo}/actions/workflows/release_rpms.yml/dispatches

That is an Actions: write operation — the App was granted that permission for exactly this reason.

Outside this repo, simp/gha-workflows has two consumers: org_sync_forks.yml (already migrated and verified) and puppet_create_release_tag.yml (tracked as simp/gha-workflows#8).

The change

Replace the github-token: value in each of the three templates with an App-minted token, matching the pattern in org_sync_forks.yml:

    env:
      APP_ID: ${{ secrets.SIMP_APP_ID }}
    steps:
      - name: 'Mint a GitHub App installation token'
        id: app-token
        if: env.APP_ID != ''
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.SIMP_APP_ID }}
          private-key: ${{ secrets.SIMP_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

SIMP_APP_ID and SIMP_APP_PRIVATE_KEY are already org-level secrets, so no per-repo secret work is needed — only the template change plus a fleet sync.

Keeping || secrets.SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE as a fallback during rollout is recommended, so a repo that has not yet synced still releases.

Blocked on

simp/gha-workflows#8, specifically its verification step: proving that a tag pushed with an App token still triggers tag_deploy.yml. That property is why a PAT was chosen here in the first place (GITHUB_TOKEN does not trigger other workflows). App tokens are expected to, but it is unproven in this org — and if it does not hold, this migration cannot proceed as written.

Do not start the 74-repo sync until that is settled.

Sequence

1. gha-workflows#8 — prove tag-triggers-workflow, migrate puppet_create_release_tag.yml
2. Migrate the three templates here; sync the fleet
3. Confirm no repo references SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE
4. Sunset simp-auto — at that point a password reset is harmless, and the org secret can be deleted

Worth deciding along the way

Whether the App should also replace simp-auto as the identity for puppetsync's own pushes and PRs (#75 covers HTTPS + token pushes). If so, this stops being a release-path migration and becomes the general answer to "what identity does SIMP automation use," which is probably the right framing.

Start by reading org_sync_forks.yml and verifying simp/gha-workflows#8, especially whether an App-token tag push triggers tag_deploy.yml. Then inspect the three named tag_deploy* templates and their github-token values. Done means the templates use the App-token pattern with rollout fallback, the fleet is synced, and no repository references SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE.