From 6b0fabab67eaa0b7721620fe194af580bee48cbc Mon Sep 17 00:00:00 2001
From: Sam Robson <samrobson321@gmail.com>
Date: Tue, 7 Jul 2026 13:58:19 +0100
Subject: [PATCH] feat: use codeql-ci-app for auth instead of pat

---
 .github/workflows/integration-tests.yml | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 4879d09a1..42b7ac170 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -10,6 +10,17 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      - name: Generate CI token
+        id: github-ci-app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.CODEQL_CI_APP_CLIENT_ID }}
+          owner: github
+          permission-contents: write
+          permission-actions: read
+          private-key: ${{ secrets.CODEQL_CI_APP_PRIVATE_KEY }}
+          repositories: codeql-variant-analysis-action
+
       - name: Trigger variant analysis
         id: trigger
         run: |
@@ -35,7 +46,7 @@ jobs:
           EOF
           echo "input.json: $(cat input.json)"
 
-          RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses" -X POST -d @input.json)
+          RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.github-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses" -X POST -d @input.json)
           echo "Response: $RESPONSE"
 
           ID="$(echo "$RESPONSE" | jq '.id')"
@@ -51,7 +62,7 @@ jobs:
       - name: Wait for variant analysis to complete
         run: |
           while true; do
-            RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
+            RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.github-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
             STATUS="$(echo "$RESPONSE" | jq '.status' -r)"
             ACTIONS_WORKFLOW_RUN_ID="$(echo "$RESPONSE" | jq '.actions_workflow_run_id' -r)"
             echo "Variant analysis ${{ steps.trigger.outputs.variant_analysis_id }} status: $STATUS"
@@ -68,7 +79,7 @@ jobs:
       - name: Validate variant analysis status
         id: validate
         run: |
-          RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
+          RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.github-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
           echo "Response: $RESPONSE"
           echo "Actions workflow URL: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$(echo "$RESPONSE" | jq '.actions_workflow_run_id')"
 
@@ -132,7 +143,7 @@ jobs:
             exit 1
           fi
 
-          ACTIONS_RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/actions/runs/$(echo "$RESPONSE" | jq '.actions_workflow_run_id')")
+          ACTIONS_RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.github-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/actions/runs/$(echo "$RESPONSE" | jq '.actions_workflow_run_id')")
 
           if [ "$(echo "$ACTIONS_RESPONSE" | jq '.status' -r)" != "completed" ]; then
             echo "Actions workflow status is not completed"