From c77eb504456b3ebea054dcd128a8083b05127ab3 Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Thu, 10 Sep 2026 16:59:32 +0100
Subject: [PATCH] chore: Fix Renovate dispatch token scope and pin REST API
 version

---
 .github/workflows/release_pr.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release_pr.yml b/.github/workflows/release_pr.yml
index 2a5f727..fce88b1 100644
--- a/.github/workflows/release_pr.yml
+++ b/.github/workflows/release_pr.yml
@@ -37,15 +37,28 @@ jobs:
           TAG_NAME: ${{ steps.release.outputs.tag_name }}
         with:
           prerelease: true
+      - name: Generate GitHub App token for renovate dispatch
+        id: dispatch-token
+        if: steps.release.outputs.release_created && steps.semver_parser.outputs.prerelease == ''
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        with:
+          app-id: ${{ secrets.CQ_APP_ID }}
+          private-key: ${{ secrets.CQ_APP_PRIVATE_KEY }}
+          owner: cloudquery
+          repositories: .github
+          permission-actions: write
       - name: Trigger Renovate
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         if: steps.release.outputs.release_created && steps.semver_parser.outputs.prerelease == ''
         with:
-          github-token: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ steps.dispatch-token.outputs.token }}
           script: |
             github.rest.actions.createWorkflowDispatch({
               owner: 'cloudquery',
               repo: '.github',
               workflow_id: 'renovate.yml',
               ref: 'main',
+              headers: {
+                'X-GitHub-Api-Version': '2026-03-10',
+              },
             })