use github app

[whoiskatrin]

move from PAT to github-app

[changeset-bot]

⚠️ No Changeset found

Latest commit: 692c94b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[claude]

📚 Documentation sync PR: cloudflare/cloudflare-docs#26640

This comment is automatically updated when the PR changes.

---

Generated by Claude Code for the Cloudflare Agents team

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/agents@666

commit: 692c94b

[claude]

Claude Code Review

Summary

This PR migrates from Personal Access Token (PAT) to GitHub App authentication. The changes are clean and improve security by using time-limited tokens with granular permissions.

Issues Found

1. Critical: Step 8 removal creates incomplete workflow (sync-docs.yml:150)

The PR removes Step 8 which comments on the original PR with the docs sync PR link. This breaks the user feedback loop - PR authors won't know that a docs PR was created. The step should be retained or replaced with equivalent functionality.

2. Placeholder script needs automation (sync-docs.yml:125-148)

The script still requires manual replacement of PLACEHOLDER values:

PR_NUMBER="PLACEHOLDER_PR_NUMBER"
PR_TITLE="PLACEHOLDER_PR_TITLE"
PR_URL="PLACEHOLDER_PR_URL"

These should use the actual context variables like:

PR_NUMBER=""
PR_TITLE=""
PR_URL=""

Without this fix, Claude will need to manually substitute these values, which is error-prone.

3. Token consistency issue (release.yml:47)

release.yml still uses secrets.GITHUB_TOKEN (the default GitHub token) instead of a generated app token. For consistency with the migration goal, this should also use the GitHub App pattern if cross-repo access or elevated permissions are needed. However, if the default token is sufficient for changeset operations, document why this workflow differs.

Recommendations

1. Restore Step 8 or implement alternative notification mechanism
2. Fix placeholder variables in the bash script template
3. Clarify the release.yml token strategy

The core migration is sound, but these issues need resolution before merge.