Use actions/create-github-app-token in CI instead of custom Python script

Dogfood the same approach we recommend to users. Removes the uv
dependency from CI. The Python script stays for local dev use via
run-e2e-tests.sh.

The secret changes from GH_APP_PRIVATE_KEY_PEM_B64 (base64-encoded) to
GH_APP_PRIVATE_KEY (raw PEM) — needs a corresponding update in the repo
settings.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Phlogistique

.claude/run-e2e-tests.sh

@@ -63,8 +63,8 @@ acquire_token() {
     log_info "Acquiring GitHub App token..."
 
     # Check if required environment variables are set
-    if [[ -z "$GH_APP_ID" ]] || [[ -z "$GH_APP_PRIVATE_KEY_PEM_B64" ]]; then
-        log_error "Missing required environment variables: GH_APP_ID and/or GH_APP_PRIVATE_KEY_PEM_B64"
+    if [[ -z "$GH_APP_ID" ]] || [[ -z "$GH_APP_PRIVATE_KEY" ]]; then
+        log_error "Missing required environment variables: GH_APP_ID and/or GH_APP_PRIVATE_KEY"
         return 1
     fi
 

.github/workflows/tests.yml

@@ -24,17 +24,17 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
         with:
-          version: "latest"
+          app-id: ${{ vars.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Run e2e tests
         env:
-          GH_APP_ID: ${{ vars.GH_APP_ID }}
-          GH_APP_PRIVATE_KEY_PEM_B64: ${{ secrets.GH_APP_PRIVATE_KEY_PEM_B64 }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           PRESERVE_ON_FAILURE: "1"
         run: |
-          export GH_TOKEN=$(uv run tests/get_github_app_token.py)
           gh auth setup-git
           bash tests/test_e2e.sh

tests/get_github_app_token.py

@@ -15,7 +15,7 @@
 
 Environment variables required:
 - GH_APP_ID: GitHub App ID
-- GH_APP_PRIVATE_KEY_PEM_B64: Base64-encoded private key
+- GH_APP_PRIVATE_KEY: PEM private key
 
 Usage:
     # Run with uv (automatically installs dependencies)
@@ -28,7 +28,6 @@
     export GITHUB_TOKEN=$(uv run get_github_app_token.py)
 """
 
-import base64
 import json
 import os
 import sys
@@ -99,15 +98,12 @@ def generate_installation_token():
     """Generate a new installation access token for the GitHub App."""
     # Get credentials from environment
     app_id = os.getenv("GH_APP_ID")
-    private_key_b64 = os.getenv("GH_APP_PRIVATE_KEY_PEM_B64")
+    private_key = os.getenv("GH_APP_PRIVATE_KEY")
 
-    if not all([app_id, private_key_b64]):
-        print("Error: Missing GH_APP_ID or GH_APP_PRIVATE_KEY_PEM_B64", file=sys.stderr)
+    if not all([app_id, private_key]):
+        print("Error: Missing GH_APP_ID or GH_APP_PRIVATE_KEY", file=sys.stderr)
         sys.exit(1)
 
-    # Decode private key
-    private_key = base64.b64decode(private_key_b64).decode('utf-8')
-
     # Generate JWT
     now = int(time.time())
     payload = {