build(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 in the actions group

[dependabot]

Bumps the actions group with 1 update: actions/create-github-app-token.

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

Commits

• 64ab729 chore(main): release 3.3.0 (#402)
• f3a828e ci: create signed dist commits in release workflow (#404)
• 655017f docs: clarify when owner grants access to all repositories (#378)
• 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
• a47236f feat: update permission inputs (#399)
• a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
• d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
• 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
• e85f677 test: omit stack traces from snapshots (#401)
• 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates both GitHub App token action pins to v3.3.0 and records the operational change in the Unreleased changelog.

Example: The workflow creates a repository-scoped dispatch token for openclaw/clawsweeper.

• Before: The token action runs at v3.2.0.
• After: The token action runs at v3.3.0 with the same contents-write permission and repository scope.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, source-verified maintenance patch with the prior finding fixed and all exact-head checks successful.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored dependency PR is outside the ordinary contributor proof gate; successful checks support validation but are not claimed as execution proof of the updated token action.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Repository review automation remains pinned to an older token action and its bundled dependencies.
Reason: The narrow update follows the repository's dependency maintenance pattern, and the automation area's contributor requested re-review of the completed change.

Merge readiness

✅ Ready for maintainer review

This PR is ready for maintainer consideration: the previous changelog finding is resolved, the dependency update remains necessary on main, and no actionable defects were found.

Priority: P3
Reviewed head: 4c0d5b470e9c0d02fad1a206802288d3143b9ba9

Before merge

None.

Findings

None.

Agent review details

How this fits together

The GitHub Actions dispatch workflow accepts repository events and trusted comment commands, creates scoped installation tokens, and sends review dispatches or comment reactions.

flowchart LR
 Events[Repository events] --> Trust[Existing trust gate]
 Trust --> Action[Pinned token action]
 Action --> DispatchToken[Dispatch token]
 Action --> CommentToken[Comment token]
 DispatchToken --> Dispatch[Review dispatch]
 CommentToken --> Reaction[Comment reaction]

Loading

Technical review

Best possible solution:

Land the focused dependency update with its existing repository scopes, permissions, and changelog entry.

Do we have a high-confidence way to reproduce the issue?

No bug reproduction is needed for this dependency update; source inspection verifies both old pins on main and both replacements in the PR.

Is this the best way to solve the issue?

Updating the two immutable action pins together preserves one dependency version across both token consumers and avoids unrelated workflow changes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7040f0cd32f8.

Provenance checked

• GitHub App token action pins keeps the original intent (45a3c6a: The automation baseline introduced scoped tokens for external review dispatch and target comment handling as part of feat: add shared terminal primitives #1.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Verified introduced diff and resolved prior finding: The pinned main-to-head diff contains only two action SHA replacements and one Unreleased changelog entry; the earlier reviewed head comparison confirms the requested entry was added. (CHANGELOG.md:9, 4c0d5b470e9c)
• Current main still uses the old dependency: Main pins both token steps to v3.2.0; repository restrictions, explicit permissions, trust conditions, token consumers, and workflow triggers are unchanged by this PR. (.github/workflows/clawsweeper-dispatch.yml:61, 7040f0cd32f8)
• Feature history and owner direction: The automation baseline commit added this workflow, and its author vincentkoc requested the current-head re-review after adding the changelog entry: build(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 in the actions group #106 (comment). Path history and blame identify the same baseline; follow-history stops at an unavailable creation-parent object, while the creation commit itself is readable. (.github/workflows/clawsweeper-dispatch.yml:61, 45a3c6a67bfd)
• Exact-head checks: GitHub reports 13 successful checks for the reviewed head, including workflow lint, CodeQL, runtime checks, browser smoke, and dispatch; the PR is open and mergeable. (4c0d5b470e9c)
• Pinned upstream action contract: The workflow executes this dependency directly, making its token contract relevant. GitHub resolves v3.3.0 to the proposed SHA. The upstream comparison leaves main.js and lib token creation, permission parsing, and revocation helpers unchanged; permission metadata changes do not remove any inputs used here. Repository names and explicit permissions continue into installation-token creation, and post-job revocation remains enabled. (lib/main.js, 64ab729a6294)

Labels

Label changes:

• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P3: This is a focused automation dependency update with no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (1 earlier review cycle)

• reviewed 2026-10-14T21:29:13.222Z sha 8371c86 :: needs changes before merge. :: [P3] Document the token-action update in the Unreleased changelog

Reviewed October 15, 2026, 10:55 AM ET / 14:55 UTC (Revision 2).

[vincentkoc]

@clawsweeper re-review

Please review current head 4c0d5b470e9c0d02fad1a206802288d3143b9ba9. The required Unreleased entry is added. The branch includes merged PR 107; the remaining diff is the two token-action pins plus that entry. All 13 current-head checks pass. Token scopes, permissions, and workflow triggers are unchanged.

No release operation is authorized.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38755985729
• Updated: 2026-10-15T14:57:30.851Z