[Jammy2211]

Summary

Token consolidation phase 1 moves the PyAutoHands release path off the person-owned PAT_PYAUTOLABS and onto the org-owned pyautolabs-bot GitHub App. It also removes every URL-embedded token, which closes the #319 failure class: git drops URL credentials on any redirect.

• Each release.yml job that touches another repo now mints a one-hour token with actions/create-github-app-token@v3. Each token gets the narrowest repositories: list and permission-*: set that job needs. The jobs are release, announce_release, clear_pending_release_labels, publish_release_notes, release_workspaces, bump_library_colab_urls and the three wiki_drift_issue* jobs.
• The library tag push (release) and the workspace push (release_workspaces) mint their token immediately before use. Auth goes through gh auth setup-git, or actions/checkout token: in the short jobs. Clones use persist-credentials: false so the checkout's GITHUB_TOKEN cannot shadow the App credential.
• Removed: the pat: matrix field, the secrets[matrix.project.pat] lookup, git remote set-url --push "https://$PAT@…" and every https://$PAT@ clone. The existing tag retry/idempotency logic is unchanged.
• Bot commits and tags are authored as pyautolabs-bot[bot] / 346909844+pyautolabs-bot[bot]@users.noreply.github.com (bot user id).
• release_workspaces no longer carries the unused TWINE_*/PYPI env.

Merge order: merge the Heart PR (PyAutoLabs/PyAutoHeart#316) first. This PR is safe to merge only after Heart's token push check is green on main AND no release run is live.

Phase 1b: the switch to PyPI/TestPyPI trusted publishing is left as a commented TODO(token-phase-1b) block above each twine upload, in release.yml and publish_tombstone.yml. It waits on the human registering the PyPI publishers. Until then, publishing is unchanged.

Heart YELLOW acknowledged by the human 2026-10-23 (manifest drift; PyAutoLens release validation stale).

Refs #321. This PR closes nothing; the issue closes after both PRs merge.

API Changes

No Python API change; workflow auth mechanism change.

release.yml now requires:

• vars.APP_CLIENT_ID (org variable)
• secrets.APP_PRIVATE_KEY (org secret)
• secrets.PYPI / secrets.TEST_PYPI, still required until phase 1b

PAT_PYAUTOLABS is no longer read by Hands.
See full details below.

Test Plan

• python -m pytest tests -q → 535 passed
• YAML parse of release.yml and publish_tombstone.yml. actionlint 1.7.12 reports only false positives (its bundled create-github-app-token@v3 metadata predates client-id) and the pre-existing set-output deprecation.
• grep of .github/ for PAT_PYAUTOLABS, secrets[ and URL userinfo: none found.
• The App token's push access to all five libraries is proven by PyAutoHeart#316's Token Push Check PR run (push=True ×5).
• No live release or rehearsal was dispatched. Rehearsal publishes to TestPyPI and runs none of the App-token jobs. First live proof is the next release's release job Tag step.

Full API Changes (for automation & release notes)

Removed

• release.yml: pat: matrix fields, secrets[matrix.project.pat], and the PAT_PYAUTOLABS uses in all jobs
• release.yml release_workspaces: job-level TWINE_*/PYPI env (unused)

Added

• release.yml: per-job actions/create-github-app-token@v3 steps; publish_release_notes matrix field token_repos
• release.yml, publish_tombstone.yml: commented OIDC replacement blocks (TODO(token-phase-1b))

Migration

• Org must hold APP_CLIENT_ID (variable) and APP_PRIVATE_KEY (secret). Both already exist, and the App is installed on all repos.

Generated by the PyAutoLabs agent workflow.

🤖 Generated with Claude Code