[dependabot]

Bumps actions/create-github-app-token from 3.2.0 to 3.3.0.

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

Commits

• 64ab729 chore(main): release 3.3.0 (#402)
• f3a828e ci: create signed dist commits in release workflow (#404)
• 655017f docs: clarify when owner grants access to all repositories (#378)
• 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
• a47236f feat: update permission inputs (#399)
• a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
• d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
• 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
• e85f677 test: omit stack traces from snapshots (#401)
• 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates both GitHub App token action pins from v3.2.0 to v3.3.0.

Example: An issue event queues a crawlkit review in openclaw/clawsweeper.

• Before: The dispatch token is created using actions/create-github-app-token v3.2.0.
• After: The same repository-scoped, contents-write token is requested using v3.3.0.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused, source-compatible maintenance with passing checks; confidence remains limited by the absence of direct execution evidence for the updated action.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot maintenance is outside the ordinary contributor proof gate; available checks support validation but do not demonstrate execution of the proposed pin, and inspection found no material change to token authority.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The review dispatcher uses an older release of its token-creation dependency.
Reason: The small update consumes upstream dependency fixes while retaining the existing workflow contract.

Merge readiness

✅ Ready for maintainer review

Keep open: main still uses v3.2.0, and this focused dependency update preserves the workflow’s existing inputs and scopes; no actionable defect was found.

Priority: P3
Reviewed head: fa0ff75c469d3e14cd678c42dda4fa967c74a6a0

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: No supplied run demonstrates v3.3.0 creating both scoped tokens and completing dispatch and comment acknowledgment.

Agent review details

How this fits together

The GitHub Actions dispatcher receives repository events, creates scoped App tokens, and sends review requests or comment acknowledgments through GitHub’s API.

flowchart LR
  A[Repository event] --> B[Dispatch workflow]
  B --> C[Create scoped App tokens]
  C --> D[GitHub installation API]
  D --> E[Review dispatch or comment acknowledgment]
  C --> F[Post-job token revocation]

Loading

Technical review

Best possible solution:

Land the verified upstream release pins while preserving the dispatcher’s existing token restrictions.

Do we have a high-confidence way to reproduce the issue?

This dependency update reports no crawlkit bug to reproduce; review verified the exact pin changes and upstream input compatibility without running target code.

Is this the best way to solve the issue?

Updating both existing immutable pins is an appropriately narrow maintenance change and introduces no parallel implementation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7912274ead2a.

Provenance checked

• Scoped GitHub App tokens for review dispatch and comment acknowledgment keeps the original intent (8a6a2a3: The workflow was added to dispatch repository events to ClawSweeper using separately scoped App tokens.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Exact introduced change: The pinned introduction diff changes only the two action references at lines 34 and 63; credentials, repository restrictions, permissions, conditions, and API destinations remain unchanged. (.github/workflows/clawsweeper-dispatch.yml:34, fa0ff75c469d)
• Current main and feature history: Current main retains the v3.2.0 pin. The workflow’s creation commit records the existing scoped-token dispatch design and was authored and committed by steipete. (.github/workflows/clawsweeper-dispatch.yml:34, 7912274ead2a)
• Executed dependency contract: The workflow executes this dependency with an App private key. The upstream comparison preserves contents, issues, and pull-requests permission inputs and leaves the main token-scoping and revocation source files unchanged; updated permission names do not affect these consumers. (action.yml, 64ab729a6294)
• Verified release identity: The v3.3.0 tag resolves to the proposed SHA, whose GitHub signature verification is valid. The release documents permission-input updates and production dependency fixes. (64ab729a6294)
• Checks and discussion: The head has eight successful checks and one intentionally skipped downstream-app check. The discussion contains only automated review-status comments; the successful pull_request_target dispatch does not establish execution of the proposed action pin. (fa0ff75c469d)
• Repository review policy: Read the complete root AGENTS.md; no nested workflow AGENTS.md or maintainer-notes directory exists. Applied ownership and release boundaries; the read-only review instruction precludes local validation commands that write artifacts. (AGENTS.md, fa0ff75c469d)

Likely related people:

• Peter Steinberger: Raw commit 8a6a2a3 adds .github/workflows/clawsweeper-dispatch.yml:40 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 8a6a2a387d01; files: .github/workflows/clawsweeper-dispatch.yml)

Labels

Label changes:

• add P3: Routine workflow dependency maintenance with no established user-facing failure or introduced regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine workflow dependency maintenance with no established user-facing failure or introduced regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 16, 2026, 3:38 AM ET / 07:38 UTC.