Move the danielridgebot workflows off secrets.DR_PAT onto the org GitHub App #223

Overview

We need the danielridgebot workflows to create issues with a token minted from the org's GitHub App instead of secrets.DR_PAT, because that PAT is a personal access token on a recurring expiry cycle with nothing warning us when it lapses. Its failure mode is silence — a missed GitHub Pages version bump rather than an alert — so we would not find out until someone noticed the bot had gone quiet.

Action Items

• Confirm first that the HFLA_WORKFLOW_APP_* App is installed on hackforla/devops with Issues: write, and that it has organization Projects: write. The bot creates its issues on hackforla/devops and adds them to board 73, so an installation scoped only to the bot repo is not enough. If the App cannot write to projects, that is the finding — record it on this issue rather than shipping something that silently stops adding board cards.
• In check-gh-pages-version.yml and check-ruby-version.yml, mint a token with actions/create-github-app-token from secrets.HFLA_WORKFLOW_APP_ID / secrets.HFLA_WORKFLOW_APP_PRIVATE_KEY and pass it as GH_TOKEN to the "Create issue…" step, in place of secrets.DR_PAT. Both org secrets are already readable by this repo — verified 2026-09-07.
• Leave the git push steps alone. They commit the new version file using the checkout-persisted GITHUB_TOKEN, not DR_PAT, so they are unaffected by this change.
• Decide what happens to test-issue-labels.yml, the third and last user of DR_PAT: switch it too, or delete it. It is workflow_dispatch-only, it opens issues on the bot repo itself, and the one it left behind — check-ghpages-versions#22, open since May 2024 — is that repo's only open issue, so nothing sweeps what it creates.
• Test before relying on it. On a throwaway branch, set release-versions/github-pages-gem.txt to an older value and run gh workflow run check-gh-pages-version.yml --ref <branch>. The workflow commits the real version back, so the file self-restores — but it opens a real issue on hackforla/devops with a board card, so close that issue and delete its card afterwards.
• Check the test issue carries its labels, its milestone and a card on board 73. The board card is both the most likely thing to fail and the one that fails quietly.
• Once both check workflows are confirmed working on App tokens, delete the DR_PAT repo secret. Decide separately what happens to the danielridgebot user account itself — with the PAT retired it has no remaining job.
• Note that the issue author changes from danielridgebot to the App's bot identity. Nothing we know of filters on the author, but the weekly label check and anyone reading the board will see a different name — confirm that is acceptable before merging rather than after.

Resources/Instructions

• The change is a PR on hackforla/check-ghpages-versions. This issue lives on devops because that is where the bot's issues land, where it is documented, and because the bot repo is not on board 73 and has almost no label vocabulary of its own.
• The bot's documentation: @danielridgebot-DevOps-Wiki
• DR_PAT was last rotated 2025-10-26 and confirmed working 2026-08-24, so it is currently valid. This is not urgent — it removes a recurring liability rather than fixing an outage.
• Org secrets already visible to the bot repo, verified 2026-09-07: HFLA_WORKFLOW_APP_ID, HFLA_WORKFLOW_APP_PRIVATE_KEY, HFLA_GRAPHQL_APP_ID, HFLA_GRAPHQL_APP_PRIVATE_KEY.
• Do not "fix" the issue templates' frontmatter while you are in there. update-gh-pages-version.md and update-ruby-version.md carry projects: as a board title and milestones: plural. GitHub never renders these files — the bot's own parser, github-actions/utils/parse-issue-template.js, reads the frontmatter and feeds it to gh issue create --project "$PROJECTS", where a board title is exactly what is wanted. Changing them to hackforla/73 would break the bot.
• Do not delete keepalive.yml. It looks like dead code and is load-bearing: GitHub disables scheduled workflows after 60 days with no repository commits, which is what silently killed both checks between 2026-01-07 and 2026-08-24. It is hand-rolled because the action the wiki recommends for this has been blocked by GitHub since 2025-04-21.