[DX-1107] Sync fork with upstream getsentry v4.0.0

[rokas-reizgys-tg]

Task DX-1107

Problem

This action declares runs.using: node20. GitHub removes Node 20 from the runners on 2026-09-16.

Solution

Merged upstream getsentry/action-github-app-token@v4.0.0, which already runs node24. Our fork held no functional patch, only CODEOWNERS, so package.json and yarn.lock are taken from upstream whole. The tree now matches upstream v4.0.0 plus CODEOWNERS.

action.yml changes by one line, node20 to node24. Inputs and outputs are unchanged, so consumers need only a version bump.

Testing

yarn test passes, 9 tests, on Node 24.15.0. No tag yet, and no consumer bumps in this PR.

[devex-ai-pr-review]

AI PR Review

🔒 Approval kill switch is active. Auto-approve is off (ApprovalKillSwitch).

💬 Manual DEVEX review required — unsupported file type(s): .eslintignore, action.yml; review-only file(s): .github/workflows/test.yml, dist/index.js, dist/package.json, package.json, yarn.lock.
Change risk: 🔴 High
Service tier: T3

This change merges the action-github-app-token fork with upstream v4.0.0, moving Node 20 to Node 24 and bumping many dependencies to new major versions. Some files have no matching skill and several manifest and workflow files need human review because of the major bumps.

Detailed findings

• suggestion — .github/workflows/test.yml L11: Confirm the pinned commit SHA for actions/checkout matches the v4 tag before merge. A wrong SHA will pin the workflow to the wrong commit.
• suggestion — .github/workflows/test.yml L29: This change removes the integration test that fetched a real installation token and checked out a private repo. Confirm the team accepts this loss of end-to-end coverage.
• suggestion — package.json L46: The bump of @actions/core from ^1.10.1 to ^3.0.0 skips two major versions. Verify this version exists and check the changelog for breaking API changes.
• nit — src/main.ts L34: Extract the inline type {token: string} | undefined into a named interface. This will improve readability if the auth response shape changes again.

Changes (14 files)

• ⚪ .eslintignore (removed, +0/-3)
  Removes the legacy ignore file now superseded by the ignores block in eslint.config.mjs. — unsupported file type
• 🟢 .eslintrc.json (removed, +0/-51)
  Removes the legacy ESLint config replaced by the new flat eslint.config.mjs. — cleared by js-ts-source
• 🟡 .github/workflows/test.yml (modified, +7/-17)
  Pins actions to commit SHAs, bumps Node to 24, adds a test step, and removes the live integration-test steps. — reviewed by github-actions-workflow — skill did not clear this change (see per-file finding for details)
• 🟢 README.md (modified, +1/-1)
  Updates the example usage tag from v3 to v3.1. — cleared by documentation
• ⚪ action.yml (modified, +1/-1)
  Changes the action runtime from node20 to node24. — unsupported file type
• 🔴 dist/index.js (modified, +35630/-18115)
  Regenerates the compiled bundle for the upstream v4.0.0 source and dependency set. — flagged by heuristic floor: non-dependency path mixed with dependency upgrade — js-ts-source did not clear this change
• 🟡 dist/package.json (added, +3/-0)
  Adds a package.json in dist marking the bundle output as an ES module. — reviewed by js-ts-dependency — skill did not clear this change (see per-file finding for details)
• 🟢 eslint.config.mjs (added, +52/-0)
  Adds a new flat ESLint config with TypeScript, Jest, and Prettier rule sets. — cleared by js-ts-source
• 🟢 jest.config.js (removed, +0/-15)
  Removes the standalone Jest config; settings move into the jest key in package.json. — cleared by js-ts-source
• 🟡 package.json (modified, +36/-44)
  Bumps the package to v4.0.0, switches to ESM, and upgrades all dependencies to new major versions. — reviewed by js-ts-dependency — skill did not clear this change (see per-file finding for details)
• 🟢 src/main.test.ts (added, +195/-0)
  Adds a full unit-test suite covering token masking, scoping, error paths, and GITHUB_API_URL handling. — cleared by js-ts-source
• 🟢 src/main.ts (modified, +6/-9)
  Masks the private key immediately, removes unsafe type-suppression comments with explicit typing, and awaits run() properly. — cleared by js-ts-source
• 🟢 tsconfig.json (modified, +8/-11)
  Switches the compiler target and module resolution to es2024/nodenext with verbatimModuleSyntax. — cleared by js-ts-source
• 🟡 yarn.lock (modified, +1932/-3683)
  Regenerates the lockfile to match the new dependency set in package.json. — reviewed by js-ts-dependency — skill did not clear this change (see per-file finding for details)

Why this verdict

💬 Manual DEVEX review required

• Unsupported file type(s): .eslintignore, action.yml.
• Skill did not clear: .github/workflows/test.yml, dist/index.js, dist/package.json, package.json, yarn.lock — claimed by a skill that emitted only INFO. See per-file finding.
• Heuristic floor: JavaScript/TypeScript source change with tests present — source-code risk floor is low; model must assess correctness and JS/TS best practices.
• Change risk: 🔴 High — contract/schema/breaking-grade change, or one that can't be fully reasoned about from the diff.
• Tier policy: T3 service — change risk High exceeds the Medium auto-approval ceiling for this tier; a human must approve.

Skills available

• dependency-update (auto-approves) — Claims PHP, Node, Python, and .NET dependency manifests/lockfiles under source/. Auto-approves minor/patch pins; lockfiles clear for claiming; major or structural edits stay review-only.
• source-code (auto-approves) — Claims application files under source/ (PHP, C#, JSON, YAML, SQL, Markdown, CSV, XML, NEON). Auto-approves for claiming (quality review still via the model); dangerous patterns stay review-only.
• asyncapi-spec (auto-approves) — Claims AsyncAPI at source/docs/asyncapi.yaml and message components under source/docs/asyncapi/**. Auto-approves for claiming (quality/breaking-change review still via the model); dangerous patterns stay review-only.
• docker-compose-local (auto-approves) — Claims docker-compose / compose YAML. Treats image bumps and structural local-stack edits as clearable (local-env risk cap); dangerous patterns stay review-only.
• dockerfile-dependency (auto-approves) — Claims Dockerfiles. Auto-approves minor/patch FROM / ARG VERSION bumps; major or structural Dockerfile edits stay review-only.
• documentation (auto-approves) — Claims Markdown and other documentation files. Auto-approves for claiming (quality review still via the model); dangerous patterns stay review-only.
• github-actions-workflow (auto-approves) — Claims .github/workflows/**. Auto-approves pure minor/patch uses: action@version pin bumps; major or structural workflow edits stay review-only for the LLM.
• js-ts-dependency (auto-approves) — Claims Node package manifests/lockfiles. Auto-approves minor/patch dependency pins in package.json; lockfiles clear for claiming and defer whole-PR floor to change-risk.
• js-ts-source (auto-approves) — Claims JavaScript/TypeScript source, tests, and tooling config. Auto-approves for claiming (quality review still via the model); source without tests stays a HIGH change-risk floor.
• makefile-local (auto-approves) — Claims Makefiles as local-environment changes. Auto-approves unless the patch contains a dangerous pattern.
• openapi-spec (auto-approves) — Claims OpenAPI contracts: openapi-merge.json, root openapi/swagger specs, and fragments under openapi/**. Auto-approves for claiming (quality/breaking-change review still via the model); dangerous patterns stay review-only.
• php-dependency (auto-approves) — Claims Composer manifests/lockfiles. Auto-approves minor/patch dependency pins in composer.json; lockfiles clear for claiming and defer whole-PR floor to change-risk.
• php-source (auto-approves) — Claims PHP source, tests, and tooling config. Auto-approves for claiming (quality review still via the model); source without tests stays a HIGH change-risk floor.

File categories not listed above are unsupported and require manual review. Add a skill module under src/ai_pr_review/skills/<tenant>/ to expand coverage.

---

_{🤖 Generated by ai-pr-review — review limited to files owned by @TransferGo/devex. This comment is updated in place on every commit; approvals are automatically dismissed and re-evaluated when new commits land.}

[devex-ai-pr-review]

suggestion: Confirm the pinned commit SHA for actions/checkout matches the v4 tag before merge. A wrong SHA will pin the workflow to the wrong commit.

[devex-ai-pr-review]

suggestion: The bump of @actions/core from ^1.10.1 to ^3.0.0 skips two major versions. Verify this version exists and check the changelog for breaking API changes.