From 521fc7805dd9a78d0bb7e5d34e50c1c578854faf Mon Sep 17 00:00:00 2001
From: Steven Enamakel <enamakel@tinyhumans.ai>
Date: Mon, 6 Apr 2026 14:59:02 -0700
Subject: [PATCH] Enhance GitHub Actions workflow for Docker CI image

- Added a step to generate a GitHub App token using the tibdex/github-app-token action, improving authentication for Docker image pushes.
- Updated the Docker push step to use the generated token instead of the default GITHUB_TOKEN, enhancing security and access control during the CI process.
---
 .github/workflows/docker-ci-image.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-ci-image.yml b/.github/workflows/docker-ci-image.yml
index a79a09554..bac73e19b 100644
--- a/.github/workflows/docker-ci-image.yml
+++ b/.github/workflows/docker-ci-image.yml
@@ -18,6 +18,13 @@ jobs:
     name: Build and push CI image
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: tibdex/github-app-token@v1
+        with:
+          app_id: ${{ secrets.XGITHUB_APP_ID }}
+          private_key: ${{ secrets.XGITHUB_APP_PRIVATE_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@v4
 
@@ -26,7 +33,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ steps.app-token.outputs.token }}
 
       - name: Build and push
         uses: docker/build-push-action@v6