[BUG](ci) Open uv-lock-refresh PRs as overture-pull-requester

[John McCall (lowlydba)]

What

uv-lock-refresh.yml now generates a token via actions/create-github-app-token (the overture-pull-requester app, same client-id/secret as rebase-vnext.yaml) and passes it to create-pull-request, instead of the implicit GITHUB_TOKEN.

Why

#729 fixed the workflow's PR-creation permission, but the resulting PR (#730) is stuck: every check passes except the required "OMF PR Check" linked-issue check, since a scheduled lockfile refresh has no issue to link. overture-pull-requester has a bypass for that check (it's how the vnext force-rebase clears it), and using an app token also means the PR triggers CI normally, unlike a GITHUB_TOKEN-authored one.

Fixes #731

Testing

• zizmor .github/workflows/uv-lock-refresh.yml — no findings.
• YAML validated with yaml.safe_load.
• Not run end-to-end (requires the scheduled/workflow_dispatch trigger); will confirm on the next run.

[github-actions]

🗺️ Schema reference docs preview is live!

🌍 Preview	https://staging.overturemaps.org/schema/pr/732/schema/index.html
🕐 Updated	Sep 10, 2026 18:17 UTC
📝 Commit	dd38453
🔧 env SCHEMA_PREVIEW	true

Note

♻️ This preview updates automatically with each push to this PR.

[Copilot]

🟡 Changes recommended

The workflow still checks out with GITHUB_TOKEN (despite the stated fix for #731) and the new bot sign-off email is inconsistent with the repo’s existing overture-pull-requester identity usage.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the scheduled uv.lock refresh workflow to open/update its dependency-refresh PRs using the overture-pull-requester GitHub App token rather than the default GITHUB_TOKEN, so the resulting PR can bypass the required linked-issue check and trigger CI normally.

Changes:

• Add an actions/create-github-app-token step to mint an installation token for overture-pull-requester.
• Use that token for peter-evans/create-pull-request PR creation/updates.
• Reduce job-level GITHUB_TOKEN permissions and update the commit message sign-off identity.

File summaries

File	Description
.github/workflows/uv-lock-refresh.yml	Switch PR creation for lockfile refresh to use the overture-pull-requester app token and adjust permissions/metadata accordingly.

Review details

Suppressed comments (1)

.github/workflows/uv-lock-refresh.yml:45

• The issue/PR description for #731 calls out passing the GitHub App token to both actions/checkout and create-pull-request. Here actions/checkout still uses the default GITHUB_TOKEN, which keeps the workflow partially dependent on job-level permissions and can defeat the goal of running entirely under the app identity. Passing the app token to checkout (even with persist-credentials: false) aligns with the stated fix and reduces coupling to GITHUB_TOKEN behavior.

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.