Replace tibdex/github-app-token with actions/create-github-app-token

[cwperks]

Description

The tibdex/github-app-token action is failing with:

Error: Could not create installation access token.
  [cause]: Error: Could not retrieve installation.
    [cause]: RequestError [HttpError]: Not Found (404)

This is caused by:

1. The installation_id input being deprecated/ignored in newer versions
2. The action running on Node.js 20 which is deprecated as of June 16, 2026

This PR replaces tibdex/github-app-token@v2.1.0 with the official GitHub first-party action actions/create-github-app-token@v3 across all 4 affected workflows:

• dependabot_pr.yml
• backport.yml
• auto-release.yml
• automatic-merges.yml

The official action auto-discovers the installation from the repository context (no hardcoded installation_id needed) and supports Node.js 24.

This aligns with what opensearch-java, opensearch-net, and opensearch-rs have already migrated to.

Testing

The actions/create-github-app-token action uses the same secrets (APP_ID, APP_PRIVATE_KEY) and produces the same output (steps.github_app_token.outputs.token), so downstream steps require no changes.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 4babfae.

Path	Line	Severity	Description
.github/workflows/auto-release.yml	16	high	GitHub Action dependency replaced: tibdex/github-app-token@3beb63f swapped for actions/create-github-app-token@bcd2ba4. This action handles APP_PRIVATE_KEY secrets; the new commit hash must be verified against the official actions/create-github-app-token repository. The installation_id parameter was also silently removed.
.github/workflows/automatic-merges.yml	19	high	GitHub Action dependency replaced: tibdex/github-app-token@3beb63f swapped for actions/create-github-app-token@bcd2ba4. This action handles APP_PRIVATE_KEY secrets; the new commit hash must be verified against the official actions/create-github-app-token repository. The installation_id parameter was also silently removed.
.github/workflows/dependabot_pr.yml	18	high	GitHub Action dependency replaced: tibdex/github-app-token@3beb63f swapped for actions/create-github-app-token@bcd2ba4. This action handles APP_PRIVATE_KEY secrets; the new commit hash must be verified against the official actions/create-github-app-token repository. The installation_id parameter was also silently removed.

The table above displays the top 10 most important findings.

Total: 3 | Critical: 0 | High: 3 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.