From e3e2663c0e84e2e00bd00aae1210f5fe718cf991 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Burzy=C5=84ski?= <mateuszburzynski@gmail.com>
Date: Wed, 1 Jul 2026 15:52:58 +0200
Subject: [PATCH] Add uncommitted `.github/actions/setup-bot-auth` (#687)

* Add uncommitted `.github/actions/setup-bot-auth`

* tweak codeowners
---
 .github/CODEOWNERS                        |  2 +-
 .github/actions/setup-bot-auth/action.yml | 44 +++++++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 .github/actions/setup-bot-auth/action.yml

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 3419a7f..f626dc2 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,4 +1,4 @@
-/.github/workflows/** @Andarist @bluwy @emmatown
+/.github/** @Andarist @bluwy @emmatown
 /action.yml @Andarist @bluwy @emmatown
 /scripts/bump.ts @Andarist @bluwy @emmatown
 /scripts/release.ts @Andarist @bluwy @emmatown
diff --git a/.github/actions/setup-bot-auth/action.yml b/.github/actions/setup-bot-auth/action.yml
new file mode 100644
index 0000000..823ddbe
--- /dev/null
+++ b/.github/actions/setup-bot-auth/action.yml
@@ -0,0 +1,44 @@
+name: Setup bot auth
+description: Create a GitHub App token and configure matching git identity
+
+inputs:
+  client-id:
+    description: GitHub App client ID
+    required: true
+  private-key:
+    description: GitHub App private key
+    required: true
+  permission-contents:
+    description: Contents permission for the GitHub App token
+    required: false
+    default: write
+  permission-pull-requests:
+    description: Pull requests permission for the GitHub App token
+    required: false
+
+outputs:
+  token:
+    description: GitHub App installation access token
+    value: ${{ steps.app-token.outputs.token }}
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      id: app-token
+      with:
+        client-id: ${{ inputs.client-id }}
+        private-key: ${{ inputs.private-key }}
+        permission-contents: ${{ inputs.permission-contents }}
+        permission-pull-requests: ${{ inputs.permission-pull-requests }}
+
+    - name: Setup Git user
+      shell: bash
+      run: |
+        app_user="$APP_SLUG[bot]"
+        app_id="$(gh api "/users/$app_user" --jq .id)"
+        git config user.name "$app_user"
+        git config user.email "$app_id+$app_user@users.noreply.github.com"
+      env:
+        APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}