feat: use codeql-ci-app for auth instead of pat

[sam-robson]

No description provided.

[Copilot]

Pull request overview

This PR updates the integration test GitHub Actions workflow to authenticate GitHub REST API calls using a GitHub App installation token (via actions/create-github-app-token) instead of a stored PAT secret.

Changes:

• Add a step to generate a GitHub App installation token for CI.
• Replace BOT_TOKEN-based Authorization headers in curl calls with the GitHub App token output.
• Scope the token to the codeql-variant-analysis-action repository via the workflow configuration.

Show a summary per file

File	Description
.github/workflows/integration-tests.yml	Generates a GitHub App token and uses it for CodeQL variant analysis and Actions API calls during integration tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

.github/workflows/integration-tests.yml:69

• The ACTIONS_WORKFLOW_RUN_ID variable is set, but the if condition checks ACTION_WORKFLOW_RUN_ID (missing the trailing S). This makes the check incorrect and can print an invalid Actions run URL.

            RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.github-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
            STATUS="$(echo "$RESPONSE" | jq '.status' -r)"
            ACTIONS_WORKFLOW_RUN_ID="$(echo "$RESPONSE" | jq '.actions_workflow_run_id' -r)"
            echo "Variant analysis ${{ steps.trigger.outputs.variant_analysis_id }} status: $STATUS"
            if [ "$ACTION_WORKFLOW_RUN_ID" != "null" ]; then

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Low

[mbg]

This is nonsense, I think. security-events: write is not required for MRVA.

[mbg]

Looks like the MRVA workflow at https://github.com/github/codeql-variant-analysis-action/actions/runs/28872293890/job/85638050938 failed with this change.

I wonder if this is a bad interaction between the use of the short-lived app token here, and the MRVA workflow assuming that GITHUB_TOKEN for the dispatched workflow is for the same user / gives the same permissions as the dispatching workflow?

[mbg]

This is nonsense, I think. security-events: write is not required for MRVA.