ci: open the nightly PRs as the riseproject-dev App

Branches pushed and PRs opened with GITHUB_TOKEN raise no events, so the
per-package upgrade PRs ended up with no checks at all. Mint a riseproject-dev
installation token when RISEPROJECT_APP_ID is set and commit as its bot,
falling back to GITHUB_TOKEN otherwise.

Author: luhenry

.github/workflows/nightly.yml

@@ -25,9 +25,22 @@ jobs:
   check_versions:
     runs-on: ubuntu-latest
     steps:
+      # A branch pushed or a PR opened with GITHUB_TOKEN raises no events, so
+      # the per-package PRs would sit there with no checks at all. Push and open
+      # them as the App instead; without its credentials, or on a pull request
+      # (where a fork or Dependabot has none), the job still runs, it just falls
+      # back to the checkless GITHUB_TOKEN.
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349  # v2.2.2
+        id: app-token
+        if: ${{ vars.RISEPROJECT_APP_ID != '' && github.event_name != 'pull_request' }}
+        with:
+          app-id: ${{ vars.RISEPROJECT_APP_ID }}
+          private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
 
       - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
         with:
@@ -37,7 +50,7 @@ jobs:
       # declared again per package, on that package's own branch, below.
       - name: Check versions
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
           SINCE: "2026-09-01"
         run: |
           uv run --with-requirements ci_scripts/requirements.txt python3 ci_scripts/check_versions.py \
@@ -49,14 +62,14 @@ jobs:
       - name: Open or update one PR per package
         if: github.event_name != 'pull_request'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
           REPORTS: ${{ runner.temp }}/reports
         run: |
           set -euo pipefail
 
           base=$(git rev-parse HEAD)
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          ci_scripts/git-identity.sh
 
           # Branch off main and re-declare this package alone, so the PR only
           # ever touches its own docs/packages/<pkg>.yaml (plus packages.txt and

ci_scripts/git-identity.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: 2026 The RISE Project
+# SPDX-License-Identifier: MIT
+
+# Configure the identity the automation commits under: the GitHub App bot when
+# the workflow minted an App token (APP_SLUG set by create-github-app-token),
+# the Actions bot otherwise. The numeric account id in the address is what ties
+# a commit to that bot on GitHub, and only the API knows it.
+
+set -eu
+
+if [ -n "${APP_SLUG:-}" ]; then
+    name="${APP_SLUG}[bot]"
+    id=$(gh api "/users/${APP_SLUG}%5Bbot%5D" --jq '.id')
+else
+    name="github-actions[bot]"
+    id=41898282
+fi
+
+git config user.name "$name"
+git config user.email "${id}+${name}@users.noreply.github.com"

ci_scripts/update_doc.py

@@ -321,10 +321,7 @@ def pr_exists(branch):
 
 
 def configure_git_identity():
-    git_run("config", "user.name", "github-actions[bot]")
-    git_run(
-        "config", "user.email", "41898282+github-actions[bot]@users.noreply.github.com"
-    )
+    subprocess.run([CI_SCRIPTS_DIR / "git-identity.sh"], check=True)
 
 
 def extract_pr_url(stdout):

docs/workflows.md

@@ -111,6 +111,19 @@ following workflows beyond those used for specific package builds:
    pending ones, or those matching the `version` glob of a
    `workflow_dispatch`).
 
+### The riseproject-dev App
+
+Branches pushed and pull requests opened with the default `GITHUB_TOKEN` raise
+no events, so nothing ever runs on them: the nightly upgrade PRs would sit
+there with no checks. `nightly.yml` therefore mints an installation token for
+the `riseproject-dev` GitHub App and commits as `riseproject-dev[bot]`. It
+needs the repository variable `RISEPROJECT_APP_ID` (the App's numeric App ID)
+and the repository secret `RISEPROJECT_APP_PRIVATE_KEY` (the App's private key,
+PEM included), and the App must be installed on this repository with read and
+write access to contents and pull requests, plus read access to issues. With
+the variable unset the workflow falls back to `GITHUB_TOKEN` and the
+`github-actions[bot]` identity, checkless as before.
+
 ## The RISC-V Wheels Dashboard
 
 RISE makes use of the [RISC-V