ci: use GeoSetBot app token in workflows and fix fork PR secrets (#341)

Replace GITHUB_TOKEN with GeoSetBot GitHub App installation tokens
in version-bump and sync-wiki workflows to bypass branch protections.
Switch docker-build from pull_request to pull_request_target so fork
PRs have access to secrets for Docker Hub push.

Closes #338

Co-authored-by: Ethan Bienstock <ethan.bienstock@acf.hhs.gov>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: 3 people

.github/workflows/docker-build.yml

@@ -1,7 +1,7 @@
 name: Docker Build
 
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - main
     types: [opened, synchronize, reopened]
@@ -34,6 +34,8 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -66,6 +68,8 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -100,6 +104,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v4
         with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
 
       - name: Check for sample-data changes
@@ -124,6 +129,8 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

.github/workflows/sync-wiki.yml

@@ -10,10 +10,15 @@ on:
 jobs:
   sync-wiki:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
 
     steps:
+      - name: Generate GeoSetBot token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Checkout main repo
         uses: actions/checkout@v4
 
@@ -22,7 +27,7 @@ jobs:
         with:
           repository: ${{ github.repository }}.wiki
           path: wiki-repo
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Sync wiki files
         run: |
@@ -31,8 +36,8 @@ jobs:
       - name: Push changes to wiki
         run: |
           cd wiki-repo
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "geoset-bot[bot]"
+          git config user.email "geoset-bot[bot]@users.noreply.github.com"
           git add -A
           if git diff --cached --quiet; then
             echo "No wiki changes to sync."

.github/workflows/version-bump.yml

@@ -5,10 +5,6 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
-  pull-requests: write
-
 concurrency:
   group: version-bump
   cancel-in-progress: false
@@ -20,15 +16,22 @@ jobs:
     if: "!startsWith(github.event.head_commit.message, 'chore: bump version to')"
 
     steps:
+      - name: Generate GeoSetBot token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Checkout Code
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Get PR info
         id: pr
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           PR_JSON=$(gh pr list --search "${{ github.sha }}" --state merged --json title,number --jq '.[0]')
           PR_TITLE=$(echo "$PR_JSON" | jq -r '.title // empty')
@@ -51,10 +54,10 @@ jobs:
 
       - name: Create or update Pull Request
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "geoset-bot[bot]"
+          git config user.email "geoset-bot[bot]@users.noreply.github.com"
 
           # Check for an existing open version bump PR
           EXISTING_PR=$(gh pr list --search "chore: bump version to" --state open \
@@ -104,8 +107,17 @@ jobs:
       new_version: ${{ steps.version.outputs.new_version }}
 
     steps:
+      - name: Generate GeoSetBot token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Checkout Code
         uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Extract version
         id: version
@@ -115,8 +127,8 @@ jobs:
 
       - name: Create tag
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "geoset-bot[bot]"
+          git config user.email "geoset-bot[bot]@users.noreply.github.com"
           git tag "v${{ steps.version.outputs.new_version }}"
           git push origin "v${{ steps.version.outputs.new_version }}"