chore(deps): update actions/create-github-app-token action to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/create-github-app-token	action	major	v2.2.2 → v3.0.0	v3.1.1 (+1)

---

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

v3.0.0

Compare Source

• feat!: node 24 support (#​275) (2e564a0)
• fix!: require NODE_USE_ENV_PROXY for proxy support (#​342) (4451bcb)

Bug Fixes

• remove custom proxy handling (#​143) (dce0ab0)

BREAKING CHANGES

• Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
• Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Major Changes:

• Node.js 24 support: The action has been updated to support the latest Node.js 24 runtime
• Modernized testing infrastructure: Migrated from AVA to Node.js native test runner
• Dependency cleanup: Removed unused dependencies (dotenv, ava, @sinonjs/fake-timers, execa) and moved undici to devDependencies

Breaking Changes:

1. Custom proxy handling removed: If using HTTP_PROXY or HTTPS_PROXY, users must now set NODE_USE_ENV_PROXY=1 on the action step
2. Runner version requirement: Requires Actions Runner v2.327.1 or later for self-hosted runners

Security Fixes:

• No specific security vulnerabilities addressed in this release
• The update represents a general modernization and maintenance release

🎯 Impact Scope Investigation

Usage Location:

• Single usage found in .github/workflows/release-please.yml:28
• The action is used to create a GitHub App token for the Release Please workflow
• Current configuration: Uses only app-id, private-key, and permission parameters

Proxy Usage Analysis:

• ✅ No HTTP_PROXY, HTTPS_PROXY, or NODE_USE_ENV_PROXY environment variables found in any workflow files
• The breaking change regarding proxy configuration does not affect this codebase

Runner Environment:

• ✅ All workflows use runs-on: ubuntu-latest (GitHub-hosted runners)
• No self-hosted runners detected in the repository
• GitHub-hosted runners are maintained by GitHub and already run Actions Runner v2.327.1+

Configuration Compatibility:

• ✅ Current usage only involves standard parameters (app-id, private-key, permission-*)
• No API changes to existing input parameters
• The action's output (token) remains unchanged

Dependency Impact:

• This is a GitHub Action (not a package dependency), so no impact on go.mod or other dependency files
• The update only affects the workflow execution runtime

💡 Recommended Actions

Immediate Actions:

• ✅ Safe to merge immediately - No code changes or configuration updates required
• The update can be merged without any modifications to the existing workflow

Verification Steps (Optional):

1. After merging, monitor the first execution of the release-please workflow
2. Verify that the GitHub App token is created successfully
3. Confirm that Release Please can perform its operations (create releases, update PRs)

Future Considerations:

• If self-hosted runners are added in the future, ensure they run Actions Runner v2.327.1 or later
• If proxy configuration is needed in the future, remember to set NODE_USE_ENV_PROXY=1

🔗 Reference Links

• v3.0.0 Release Notes
• v2.2.2...v3.0.0 Comparison
• Actions Runner v2.327.1 Release
• Action Repository

Generated by koki-develop/claude-renovate-review