ci(github-actions): switch to github app token and fix bot self-trigger (#26223)

Author: gundermanc

.github/workflows/gemini-cli-bot-brain.yml

@@ -41,7 +41,7 @@ jobs:
         github.event_name == 'schedule' ||
         (github.event_name == 'workflow_dispatch' && github.event.inputs.run_interactive != 'true') ||
         (github.event_name == 'workflow_dispatch' && github.event.inputs.run_interactive == 'true') ||
-        (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@gemini-cli-robot') && contains(fromJSON('["COLLABORATOR", "MEMBER", "OWNER"]'), github.event.comment.author_association))
+        (github.event_name == 'issue_comment' && github.event.comment.user.login != 'gemini-cli[bot]' && contains(github.event.comment.body, '@gemini-cli') && contains(fromJSON('["COLLABORATOR", "MEMBER", "OWNER"]'), github.event.comment.author_association))
       )
     # The reasoning phase is strictly readonly.
     permissions:
@@ -190,6 +190,17 @@ jobs:
       pull-requests: 'write'
       actions: 'write'
     steps:
+      - name: 'Generate GitHub App Token 🔑'
+        id: 'generate_token'
+        if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
+        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b' # ratchet:actions/create-github-app-token@v2
+        with:
+          app-id: '${{ secrets.APP_ID }}'
+          private-key: '${{ secrets.PRIVATE_KEY }}'
+          owner: '${{ github.repository_owner }}'
+          repositories: '${{ github.event.repository.name }}'
+          permissions: '{"contents": "write", "pull_requests": "write", "issues": "write", "workflows": "write"}'
+
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
@@ -206,11 +217,11 @@ jobs:
       - name: 'Create or Update PR'
         if: "${{ github.event.inputs.enable_prs == 'true' || github.event_name == 'issue_comment' || github.event.inputs.run_interactive == 'true' }}"
         env:
-          GH_TOKEN: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
         run: |
           if [ -s "${{ runner.temp }}/brain-data/bot-changes.patch" ]; then
-            git config user.name "gemini-cli-robot"
-            git config user.email "gemini-cli-robot@google.com"
+            git config user.name "gemini-cli[bot]"
+            git config user.email "gemini-cli[bot]@users.noreply.github.com"
             git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
 
             BRANCH_NAME="bot/productivity-updates-$(date +'%Y%m%d%H%M%S')-${{ github.run_id }}"
@@ -248,21 +259,22 @@ jobs:
 
       - name: 'Post PR/Issue Comment'
         env:
-          GH_TOKEN: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
+          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
           TRIGGER_ISSUE_NUMBER: '${{ github.event.issue.number || github.event.inputs.issue_number }}'
         run: |
           if [ -s "${{ runner.temp }}/brain-data/issue-comment.md" ] && [ -n "$TRIGGER_ISSUE_NUMBER" ]; then
             echo "Posting comment to triggering issue #$TRIGGER_ISSUE_NUMBER"
-            gh issue comment "$TRIGGER_ISSUE_NUMBER" -F "${{ runner.temp }}/brain-data/issue-comment.md"
+            # Use REST API (gh api) instead of GraphQL (gh issue comment) to ensure robot identity
+            # while avoiding potential GraphQL-specific authorization hurdles with PATs.
+            gh api "repos/${{ github.repository }}/issues/$TRIGGER_ISSUE_NUMBER/comments" -F body=@"${{ runner.temp }}/brain-data/issue-comment.md"
           fi
 
           if [ -s "${{ runner.temp }}/brain-data/pr-comment.md" ] && [ -f "${{ runner.temp }}/brain-data/pr-number.txt" ]; then
             PR_NUM=$(cat "${{ runner.temp }}/brain-data/pr-number.txt")
-            PR_AUTHOR=$(gh pr view "$PR_NUM" --json author --jq '.author.login')
-            if [ "$PR_AUTHOR" != "gemini-cli-robot" ]; then
-              echo "Error: PR #$PR_NUM is authored by '$PR_AUTHOR', not 'gemini-cli-robot'. Safety abort."
-              exit 1
-            fi
 
-            gh pr comment "$PR_NUM" -F "${{ runner.temp }}/brain-data/pr-comment.md"
+            # Using GitHub App, so author check is no longer valid against gemini-cli-robot
+            # Skipping author validation here to let the app post.
+
+            # Use REST API (gh api) for consistency and robot identity
+            gh api "repos/${{ github.repository }}/issues/$PR_NUM/comments" -F body=@"${{ runner.temp }}/brain-data/pr-comment.md"
           fi