[quality] push-repacked-dist cannot mint its App token: Dependabot secrets REPACK_APP_ID / REPACK_APP_PRIVATE_KEY are not configured #452

Finding

.github/workflows/test.yml:115-123 (push-repacked-dist, added by #390 / 15802ac) runs actions/create-github-app-token with

app-id: ${{ secrets.REPACK_APP_ID }}
private-key: ${{ secrets.REPACK_APP_PRIVATE_KEY }}

On dependabot branches the step reads Dependabot secrets, and those two have never been configured. Latest evidence, PR #440 (js-yaml 5.4.2 → 5.4.3, run 38068101038):

• repack-dist succeeded with changed=true and uploaded the artifact — the job pair works.
• push-repacked-dist failed at step 1: "The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context."
• build-test therefore stays red on the "Verify committed dist/ matches source" gate, exactly the [quality] dependabot PRs bumping ncc-bundled deps always fail the dist/ gate — add a repack-dist job to test.yml #171 class that ci: repack dist/ on dependabot branches without exposing a write token #390 was meant to retire.

This was previously recorded only as a folded comment on #422, which was closed on 2026-10-11 without the secrets being added, so nothing open tracks it now. Every future dependabot bump of an ncc-bundled runtime dependency (js-yaml, @actions/*, …) will reproduce it.

Recommendation

No repository change can fix this; it needs a maintainer with repo-settings access (needs-human: Dependabot secrets are not writable by any agent or workflow). Please choose one:

• (preferred) Add REPACK_APP_ID and REPACK_APP_PRIVATE_KEY under Settings → Secrets and variables → Dependabot (same values as the Actions-scoped App used by prow-bot.yml, or a dedicated App with contents: write on this repo), then re-run build-test on chore(deps): bump js-yaml from 5.4.2 to 5.4.3 in the production-dependencies group #440 to confirm push-repacked-dist pushes the repacked dist/.
• Or decide that bundled-dep dependabot PRs are hand-repacked (as for chore(deps-dev): bump the dev-dependencies group across 1 directory with 5 updates #188 via 7e70949) and remove the push-repacked-dist job so it stops reporting a red check on every such PR.

Priority

• Impact: medium (every bundled-dep dependabot PR is permanently red until a human intervenes)
• Effort: low (two secrets)

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: ab87871

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88