From 4bd16b89ce064b265c0a12535899cd49f13cf00d Mon Sep 17 00:00:00 2001
From: Tam Nhu Tran <kaitran.ntt@gmail.com>
Date: Tue, 14 Apr 2026 17:22:50 -0400
Subject: [PATCH] fix(ci): restore PR-Agent reviewer bot identity

---
 .github/workflows/ai-review.yml                      | 10 +++++++++-
 tests/unit/scripts/github/ai-review-workflow.test.ts |  6 +++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 1f482bad..40e84de8 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -93,7 +93,6 @@ jobs:
       pull-requests: write
       contents: read
     env:
-      GITHUB_TOKEN: ${{ github.token }}
       OPENAI_KEY: ${{ secrets.AI_REVIEW_API_KEY }}
       "OPENAI.API_BASE": ${{ vars.AI_REVIEW_BASE_URL }}
       "config.model": ${{ vars.AI_REVIEW_MODEL }}
@@ -102,5 +101,14 @@ jobs:
       "github_action_config.auto_improve": "false"
 
     steps:
+      - name: Generate App Token
+        id: pr-agent-app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CCS_REVIEWER_APP_ID }}
+          private-key: ${{ secrets.CCS_REVIEWER_PRIVATE_KEY }}
+
       - name: Run PR-Agent
         uses: qodo-ai/pr-agent@v0.34
+        env:
+          GITHUB_TOKEN: ${{ steps.pr-agent-app-token.outputs.token }}
diff --git a/tests/unit/scripts/github/ai-review-workflow.test.ts b/tests/unit/scripts/github/ai-review-workflow.test.ts
index 6e1c8573..3e396e74 100644
--- a/tests/unit/scripts/github/ai-review-workflow.test.ts
+++ b/tests/unit/scripts/github/ai-review-workflow.test.ts
@@ -16,11 +16,12 @@ describe('PR-Agent review lane migration', () => {
 
     const workflow = fs.readFileSync(workflowPath, 'utf8');
     const config = fs.readFileSync(prAgentConfigPath, 'utf8');
+    const appTokenUsages = workflow.match(/uses: actions\/create-github-app-token@v1/g) ?? [];
 
     expect(workflow).toContain('name: AI Code Review');
     expect(workflow).toContain('runs-on: [self-hosted, cliproxy]');
     expect(workflow).toContain('uses: qodo-ai/pr-agent');
-    expect(workflow).toContain('uses: actions/create-github-app-token@v1');
+    expect(appTokenUsages).toHaveLength(2);
     expect(workflow).toContain('OPENAI.API_BASE');
     expect(workflow).toContain('OPENAI_KEY');
     expect(workflow).toContain('vars.AI_REVIEW_BASE_URL');
@@ -34,6 +35,9 @@ describe('PR-Agent review lane migration', () => {
     expect(workflow).toContain("format('dispatch-{0}', github.run_id)");
     expect(workflow).toContain('CCS_REVIEWER_APP_ID');
     expect(workflow).toContain('CCS_REVIEWER_PRIVATE_KEY');
+    expect(workflow).toContain('id: pr-agent-app-token');
+    expect(workflow).toContain('GITHUB_TOKEN: ${{ steps.pr-agent-app-token.outputs.token }}');
+    expect(workflow).not.toContain('GITHUB_TOKEN: ${{ github.token }}');
     expect(workflow).not.toContain('uses: anthropics/claude-code-action@v1');
 
     expect(config).toContain('[config]');