[OPS-1301] Use baton-ci app token in capabilities_and_config.yaml

[ennyjfrick]

Replace the long-lived RELENG_GITHUB_TOKEN PAT with a short-lived baton-ci app token scoped to the current repo.

Mirrors the OPS-1300 templated workflow pattern. With the Connector Rules ruleset hardened, the legacy PAT only continues to work because of the temp org-admin mitigation; this PR replaces it with the proper App-token bypass actor before that mitigation is removed.

Linear: OPS-1301

🤖 Generated with Claude Code

[linear]

OPS-1301 Replace RELENG_GITHUB_TOKEN in legacy untemplated capabilities workflows

[github-actions]

Claude finished @ennyjfrick's task in 45s —— View job

---

PR Review: [OPS-1301] Use baton-ci app token in capabilities_and_config.yaml

• Gather context and read changed files
• Review PR changes
• Post review feedback

---

LGTM — clean, well-scoped change. A few observations:

What this does

Replaces the long-lived RELENG_GITHUB_TOKEN PAT in capabilities_and_config.yaml with a short-lived GitHub App token minted via actions/create-github-app-token@v2. The token is scoped to the current repo only (repositories: ${{ github.event.repository.name }}), which is the minimum privilege needed.

Correctness

• Token minting before checkout — correctly placed so the token is available when actions/checkout@v4 needs it (line 14–21 → line 24–26).
• EndBug/add-and-commit — this action reuses the token from checkout by default, so the commit-and-push step (line 43–49) will inherit the app token. No additional token plumbing needed. ✅
• Pattern matches update-dependencies.yaml — the same baton-ci minting block is already used in update-dependencies.yaml, so this is a consistent migration. ✅

Notes

• RELENG_GITHUB_TOKEN still remains in verify.yaml and release.yaml. Presumably those are tracked under separate tickets (OPS-1300 templated workflows), but worth confirming they're on the migration backlog.
• No functional or security concerns with this change. Short-lived, repo-scoped app tokens are strictly better than a long-lived PAT.

Verdict: Approve ✅

[ennyjfrick]

Closing — switching this connector to baton-admin-managed metadata via baton-admin#448. The legacy file becomes duplicate of the modern generate-baton-metadata.yaml once that lands and the Pulumi fan-out runs. Replacing this migration PR with a deletion PR.