From 0cefbe6d8f8a042959e574384cb936d1ed75b867 Mon Sep 17 00:00:00 2001
From: Steven Enamakel <31011319+senamakel@users.noreply.github.com>
Date: Sat, 9 May 2026 14:38:00 -0700
Subject: [PATCH] fix(ci): switch rabbit-retrigger to a PAT in `Review`
 environment (#1430)

---
 .github/workflows/rabbit-retrigger.yml | 46 ++++++--------------------
 1 file changed, 10 insertions(+), 36 deletions(-)

diff --git a/.github/workflows/rabbit-retrigger.yml b/.github/workflows/rabbit-retrigger.yml
index fbce806c7..9115c618c 100644
--- a/.github/workflows/rabbit-retrigger.yml
+++ b/.github/workflows/rabbit-retrigger.yml
@@ -1,8 +1,9 @@
 ---
 name: CodeRabbit Retrigger
 # Periodically scans open PRs and posts `@coderabbitai review` on any whose
-# rate-limit window has elapsed. Uses the same GitHub App credentials as
-# release-production.yml so the comments are authored by the bot account.
+# rate-limit window has elapsed. CodeRabbit ignores comments authored by a
+# GitHub App, so this workflow uses a personal access token (`RABBIT_PAT`)
+# scoped to the `Review` environment.
 on:
   schedule:
     # Every 20 minutes. CodeRabbit Pro reviews 5 PRs/hr, so this gives
@@ -30,18 +31,13 @@ jobs:
   retrigger:
     name: Retrigger CodeRabbit
     runs-on: ubuntu-22.04
-    # XGITHUB_APP_ID / XGITHUB_APP_PRIVATE_KEY are scoped to the Production
-    # environment (same as release-production.yml). Without this declaration
-    # the secrets resolve to empty and tibdex/github-app-token errors with
-    # "Input required and not supplied: app_id".
-    environment: Production
+    # CodeRabbit ignores `@coderabbitai review` comments posted under a
+    # GitHub App identity, so this workflow uses a personal access token
+    # scoped to the `Review` environment instead. Set `RABBIT_PAT` on the
+    # `Review` environment in repo settings — a fine-grained PAT with
+    # `pull-requests: write` and `issues: write` on this repo is enough.
+    environment: Review
     steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: tibdex/github-app-token@v1
-        with:
-          app_id: ${{ secrets.XGITHUB_APP_ID }}
-          private_key: ${{ secrets.XGITHUB_APP_PRIVATE_KEY }}
       - name: Checkout
         uses: actions/checkout@v4
         with:
@@ -50,31 +46,9 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24.x
-      - name: Diagnose App token identity
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          set -e
-          echo "== gh auth status =="
-          gh auth status || true
-          echo
-          echo "== App installation identity =="
-          # `/installation/repositories` works for an installation access token
-          # and confirms which repos the App can write to. If this doesn't list
-          # tinyhumansai/openhuman or shows zero permissions, the App isn't
-          # installed on the repo (or the new perms haven't been accepted yet).
-          gh api /installation/repositories \
-            --jq '{total_count, perms: .repositories[0].permissions, repos: [.repositories[].full_name]}' \
-            || echo "(installation listing failed)"
-          echo
-          echo "== Posting permission probe =="
-          # GET on the comments endpoint requires `issues:read` (or pull-requests:read).
-          # POST requires `issues:write`. We only GET here so we don't pollute PRs.
-          gh api -i /repos/${GITHUB_REPOSITORY}/issues/1421/comments?per_page=1 \
-            2>&1 | head -20 || true
       - name: Run rabbit
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.RABBIT_PAT }}
           RABBIT_REPO: ${{ github.repository }}
         run: |
           set -e