feat(update-copilot-skills): optional App token so update PRs trigger CI

.github/workflows/update-copilot-skills.yaml

@@ -43,6 +43,22 @@ on:
         required: false
         default: false
         type: boolean
+      use-app-token:
+        description: >-
+          When `true`, create the update PR with a GitHub App token (minted from the `APP_ID`
+          variable and the `APP_PRIVATE_KEY` secret) instead of the default `GITHUB_TOKEN`. A PR
+          opened with `GITHUB_TOKEN` does NOT trigger the caller's `on: pull_request`/`push` CI runs,
+          so its required checks never report and it stays blocked; an App token avoids this.
+          Defaults to `false` (previous behaviour using `GITHUB_TOKEN`).
+        required: false
+        default: false
+        type: boolean
+    secrets:
+      APP_PRIVATE_KEY:
+        description: >-
+          GitHub App private key, required only when `use-app-token` is `true`. Paired with the
+          `APP_ID` repository/organization variable to mint an App token for PR creation.
+        required: false
 
 permissions: {}
 
@@ -55,10 +71,24 @@ jobs:
       contents: write
       pull-requests: write
     steps:
+      - name: 🔑 Generate GitHub App token
+        id: app-token
+        if: ${{ inputs.use-app-token }}
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          # Scope the token to least privilege — exactly what this job needs
+          # (checkout read + create-pull-request push/open) — instead of
+          # inheriting the App installation's blanket permissions.
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: 📄 Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          persist-credentials: true
+          persist-credentials: false
+          token: ${{ steps.app-token.outputs.token || github.token }}
 
       - name: 🔄 Update installed skills
         id: update
@@ -85,3 +115,5 @@ jobs:
           branch: ${{ inputs.pr-branch }}
           labels: ${{ inputs.pr-labels }}
           delete-branch: true
+          token: ${{ steps.app-token.outputs.token || github.token }}
+          branch-token: ${{ steps.app-token.outputs.token || github.token }}