From ca28d39ec42ba52f63974a10af4aedd24071f03f Mon Sep 17 00:00:00 2001
From: 2 * r + 2 * t <61896496+soramanew@users.noreply.github.com>
Date: Fri, 20 Mar 2026 19:10:08 +1100
Subject: [PATCH] ci: update flake use gh app to push

---
 .github/workflows/update-flake-inputs.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/update-flake-inputs.yml b/.github/workflows/update-flake-inputs.yml
index 1a8bd071..c52c5e1b 100644
--- a/.github/workflows/update-flake-inputs.yml
+++ b/.github/workflows/update-flake-inputs.yml
@@ -3,17 +3,24 @@ name: Update flake inputs
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 0 * * 0'
+    - cron: "0 0 * * 0"
 
 jobs:
   update-flake:
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: write
-
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
 
       - name: Install Nix
         uses: nixbuild/nix-quick-install-action@v31
@@ -80,6 +87,7 @@ jobs:
         if: steps.check.outputs.modified == 'true'
         uses: EndBug/add-and-commit@v9
         with:
+          token: ${{ steps.app-token.outputs.token }}
           add: flake.lock
           default_author: github_actions
           message: "[CI] chore: update flake"