ci(gitleaks): authenticate the updater with the App client id

[eleshar]

Summary

Authenticates the gitleaks version updater with the client-id input on actions/create-github-app-token, reading the new DEP_MERGE_APP_CLIENT_ID repository variable, instead of the deprecated app-id.

docs/CHECKPOINT.md in dependency-merge-controller records the intended convention for the lightspeed-dependency-merge App as vars.DEP_MERGE_APP_CLIENT_ID + secrets.DEP_MERGE_APP_PRIVATE_KEY, with no DEP_MERGE_APP_ID. The earlier repair used app-id, which worked but diverged. This realigns them and clears the deprecation warning as a side effect. The deprecation was never the cause of the original failure.

Least-privilege permissions are untouched: contents: write to push the deps/gitleaks-* branch, pull-requests: write to open the update PR, and workflows: write because the diff edits gitleaks-reusable.yml.

DEP_MERGE_APP_CLIENT_ID is already set on this repository, so the token step resolves on merge. The app-id form is verified working in run 30790979429 (Already on 8.30.1); this PR swaps the input only. DEP_MERGE_APP_ID is deleted only after the client-id workflow is live.

Linked issues

• Harden the gitleaks implementation: pin version, verify checksum, least privilege #1454 — gitleaks pinning and checksum verification; this completes its App authentication convention.
• fix(ci): use a block scalar so issue-remediation-bulk.yml parses #1491 — block-scalar fix for issue-remediation-bulk.yml, merged first so workflow parsing is clean.

Changelog

• Gitleaks updater App authentication — switched gitleaks-update.yml to the client-id input on actions/create-github-app-token, reading the new DEP_MERGE_APP_CLIENT_ID variable, replacing the deprecated app-id form. Aligns with the lightspeed-dependency-merge convention used by the dependency auto-merge controller. The App's least-privilege permission set (contents, pull-requests, workflows) is unchanged.

Checklist (Global DoD / PR)

• Single-concern change: one workflow input plus its CHANGELOG entry
• Least-privilege permissions unchanged
• No secrets, credentials or tokens committed
• Client ID verified against live GitHub App configuration (app_id 4461489)
• CHANGELOG entry included above
• Linked issues recorded
• Rollback is a one-line revert; app-id stays functional until the variable is deleted

[coderabbitai]

✅ Template check passed after update. Thanks for fixing the PR description.

[github-actions]

⏱️ Aging and SLA annotation

• Age: 0 day(s)
• SLA state: Within SLA
• Thresholds: warn at 7 days, breach at 14 days
• Last updated: 2026-08-03T12:07:40.471Z

Maintained by project-meta-sync workflow.

[github-actions]

🚫 This PR description is missing required template content.

Missing required section(s): Linked issues, Changelog, Global DoD checklist

Please update the PR body using one of the repository PR templates:

• https://github.com/lightspeedwp/.github/blob/develop/.github/pull_request_template.md
• https://github.com/lightspeedwp/.github/tree/develop/.github/PULL_REQUEST_TEMPLATE

Empty placeholders, unchecked checklist boxes, and stub issue references do not count.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Around line 96-97: Add the required pull request and related issue links to
the new [Unreleased] changelog entry for “Gitleaks updater App authentication,”
following the existing link format used by neighboring entries.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: d46b396f-9824-4721-a54f-58d596c6ea6c

📥 Commits

Reviewing files that changed from the base of the PR and between a14b5ad and b7f60c8.

📒 Files selected for processing (2)

• .github/workflows/gitleaks-update.yml
• CHANGELOG.md

📜 Review details

⏰ Context from checks skipped due to timeout. (13)

• GitHub Check: scan / Scan for secrets
• GitHub Check: front-matter-validate
• GitHub Check: coderabbit-gate
• GitHub Check: lint-and-links
• GitHub Check: Validate changelog on PR
• GitHub Check: validate-pr-template
• GitHub Check: Validation
• GitHub Check: Testing
• GitHub Check: Mergify Merge Protections
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (python)
• GitHub Check: Summary
• GitHub Check: Validate Mermaid Diagrams

🧰 Additional context used

📓 Path-based instructions (5)

**/.github/workflows/*.yml

⚙️ CodeRabbit configuration file

**/.github/workflows/*.yml: Review GitHub Actions workflows for this governance repo:

• Security: check for least-privilege permissions (use permissions: at job level, default to read-only).
• Secret handling: ensure secrets are passed via env vars, not interpolated directly into run: steps to prevent injection.
• Action pinning: prefer SHA-pinned actions over mutable tags (e.g. actions/checkout@v4 is acceptable; SHA pins are better).
• No pull_request_target with untrusted code execution unless explicitly justified.
• Avoid storing sensitive outputs as unmasked step outputs.
• Check for reusable workflow patterns and matrix strategies where appropriate.
• Validate on: triggers: ensure branch/path filters are present to avoid unnecessary runs.
• Confirm workflows are documented, DRY, and maintainable.
• Ensure agent-triggered workflows use workflow_dispatch with defined inputs.

Files:

• .github/workflows/gitleaks-update.yml

**/*

📄 CodeRabbit inference engine (CLAUDE.md)

**/*: Do not place reusable AI assets under .github/; store them in the appropriate top-level portable asset folder.
Portable JSON schemas belong in the root .schemas/ directory; portable agents belong in agents/; permanent human documentation belongs in docs/; temporary scratch files belong in .github/tmp/ and must be cleaned up.
Do not commit node_modules/, build/, or other generated artefacts.

**/*: Use UK English and optimise solutions for clarity, scalability, maintainability, and profitable outcomes.
Prefer minimal, modular solutions; justify heavier tools based on return on investment and maintenance cost.

Files:

• CHANGELOG.md

**/*.md

📄 CodeRabbit inference engine (CLAUDE.md)

Use UK English throughout documentation and Markdown content, including spellings such as optimise, organisation, colour, and behaviour.

**/*.md: Documentation and AI infrastructure files must follow their applicable documented standards, including required structure, frontmatter, quality gates, and validation.
Run Markdown linting with npm run lint:md and validate frontmatter with npm run validate:frontmatter where applicable.

Files:

• CHANGELOG.md

**/*.{md,yml,yaml,json}

📄 CodeRabbit inference engine (CLAUDE.md)

Do not use a references frontmatter field; use inline links or footer sections instead.

Files:

• CHANGELOG.md

CHANGELOG.md

⚙️ CodeRabbit configuration file

CHANGELOG.md: Review CHANGELOG.md:

• Confirm entries follow Keep a Changelog 1.1.0 format.
• Each entry under [Unreleased] must include a PR link and issue link.
• Verify entries use the correct section headings (Added, Changed, Fixed, Deprecated, Removed, Security, Documentation, Performance).
• Check UK English spelling throughout.

Files:

• CHANGELOG.md

🔇 Additional comments (1)

.github/workflows/gitleaks-update.yml (1)

30-30: LGTM!

[github-actions]

🔍 Reviewer Summary for PR #1456

CI Status: ❌ success
Files changed: 2
Risk Distribution: 1 critical, 0 high, 0 medium, 1 low

Recommendations

• ⚠️ 1 critical-risk file(s) modified (workflows, secrets)
• ⚠️ Security-sensitive files modified (review carefully)

---

[coderabbitai]

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main CI change: authenticating the Gitleaks updater with the App client ID.
Description check	✅ Passed	The description explains the change, risks, permissions, linked issues, changelog, rollback, and verification, but omits the template's detailed risk and test sections.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}