From 30673a364445c2633a7e1b821c718ebf2480fa9b Mon Sep 17 00:00:00 2001
From: Charis <26616127+charislam@users.noreply.github.com>
Date: Thu, 8 Jan 2026 12:43:26 -0500
Subject: [PATCH] ci(studio): use app token for ratchet decrease workflow
 (#41799)

We're using the default GITHUB_TOKEN to create the ratchet baseline
decrease PR. By default, this does not auto-run the PR checks to prevent
infinite loops.

Switching to a GitHub App token instead so the PR checks will auto-run.
---
 .github/workflows/studio-lint-ratchet-decrease.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/studio-lint-ratchet-decrease.yml b/.github/workflows/studio-lint-ratchet-decrease.yml
index 27d3f968e03..4598a0cf7fb 100644
--- a/.github/workflows/studio-lint-ratchet-decrease.yml
+++ b/.github/workflows/studio-lint-ratchet-decrease.yml
@@ -35,9 +35,16 @@ jobs:
       - name: Install deps
         run: pnpm install --frozen-lockfile
 
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        with:
+          app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
+          private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
+
       - name: Decrease ESLint ratchet baselines and open PR
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           set -eo pipefail