From 1de26972fff5d7e205db4f0bf0ec475cef5171ec Mon Sep 17 00:00:00 2001
From: Ibrahim Halatci <ihalatci@microsoft.com>
Date: Fri, 3 Jul 2026 15:52:18 +0300
Subject: [PATCH] Use GitHub App token in nightly package build

The shared org PAT (secrets.GH_TOKEN) was retired after the packaging repo migrated to a GitHub App token, breaking the nightly: the citus/packaging container resolves the citus commit ref via an authenticated GitHub API call that fail-closes on 401.

Mint a GitHub App token with actions/create-github-app-token@v3 and export both GH_TOKEN and GITHUB_TOKEN to the environment (the container's ~/.curlrc consumes GITHUB_TOKEN). Mirrors the proven pattern already green in citus-package-all-platforms-test.yml and packaging PR #1189.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../workflows/build-citus-community-nightlies.yml  | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-citus-community-nightlies.yml b/.github/workflows/build-citus-community-nightlies.yml
index 6e7820d0..e1f104c3 100644
--- a/.github/workflows/build-citus-community-nightlies.yml
+++ b/.github/workflows/build-citus-community-nightlies.yml
@@ -4,7 +4,6 @@ env:
   MAIN_BRANCH: "all-citus"
   PACKAGING_PASSPHRASE: ${{ secrets.PACKAGING_PASSPHRASE }}
   PACKAGING_SECRET_KEY: ${{ secrets.PACKAGING_SECRET_KEY }}
-  GH_TOKEN: ${{ secrets.GH_TOKEN }}
   DOCKERHUB_USER_NAME: ${{ secrets.DOCKERHUB_USER_NAME }}
   DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
 on:
@@ -38,6 +37,19 @@ jobs:
           fetch-depth: 1
           path: tools
 
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_KEY }}
+          owner: citusdata
+
+      - name: Export GitHub App token to environment
+        run: |
+          echo "GH_TOKEN=${{ steps.app-token.outputs.token }}" >> "$GITHUB_ENV"
+          echo "GITHUB_TOKEN=${{ steps.app-token.outputs.token }}" >> "$GITHUB_ENV"
+
       # This step is to fetch the images unanonymously to have higher bandwidth
       - name: Login to Docker Hub
         uses: docker/login-action@v4