From d0cfc70a0cf43fb5985315ab47aeb57e5d626ded Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Thu, 10 Sep 2026 16:45:05 +0100
Subject: [PATCH 1/4] fix: Scope GitHub App token to .github repo for Renovate
 dispatch

---
 .github/workflows/release_pr.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release_pr.yml b/.github/workflows/release_pr.yml
index f31506a2..a6e2a556 100644
--- a/.github/workflows/release_pr.yml
+++ b/.github/workflows/release_pr.yml
@@ -37,11 +37,21 @@ jobs:
           TAG_NAME: ${{ steps.release.outputs.tag_name }}
         with:
           prerelease: true
+      - name: Generate GitHub App token for renovate dispatch
+        id: dispatch-token
+        if: steps.release.outputs.release_created && steps.semver_parser.outputs.prerelease == ''
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        with:
+          app-id: ${{ secrets.CQ_APP_ID }}
+          private-key: ${{ secrets.CQ_APP_PRIVATE_KEY }}
+          owner: cloudquery
+          repositories: .github
+          permission-actions: write
       - name: Trigger Renovate
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         if: steps.release.outputs.release_created && steps.semver_parser.outputs.prerelease == ''
         with:
-          github-token: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ steps.dispatch-token.outputs.token }}
           script: |
             github.rest.actions.createWorkflowDispatch({
               owner: 'cloudquery',

From 967469a8ad39a621591ebda2f4117818061ae7b4 Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Thu, 10 Sep 2026 16:46:33 +0100
Subject: [PATCH 2/4] fix: Pin REST API version for Renovate dispatch

---
 .github/workflows/release_pr.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release_pr.yml b/.github/workflows/release_pr.yml
index a6e2a556..05c1e910 100644
--- a/.github/workflows/release_pr.yml
+++ b/.github/workflows/release_pr.yml
@@ -58,4 +58,7 @@ jobs:
               repo: '.github',
               workflow_id: 'renovate.yml',
               ref: 'main',
+              headers: {
+                'X-GitHub-Api-Version': '2026-03-10',
+              },
             })

From e94a353a062bac1e7cf0f196b084abde49be4609 Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Thu, 10 Sep 2026 16:53:32 +0100
Subject: [PATCH 3/4] fix: Replace unmaintained ws-action-parse-semver with
 inline semver parse

---
 .github/workflows/release_pr.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release_pr.yml b/.github/workflows/release_pr.yml
index 05c1e910..4c21eaed 100644
--- a/.github/workflows/release_pr.yml
+++ b/.github/workflows/release_pr.yml
@@ -26,9 +26,11 @@ jobs:
       - name: Parse semver string
         if: steps.release.outputs.release_created
         id: semver_parser
-        uses: booxmedialtd/ws-action-parse-semver@7784200024d6b3fc01253e617ec0168daf603de3
-        with:
-          input_string: ${{ steps.release.outputs.tag_name }}
+        env:
+          TAG_NAME: ${{ steps.release.outputs.tag_name }}
+        run: |
+          prerelease="$(printf '%s' "${TAG_NAME#v}" | sed -n 's/^[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*-\([^+]*\).*$/\1/p')"
+          echo "prerelease=${prerelease}" >> "$GITHUB_OUTPUT"
       - name: Mark as pre-release
         if: steps.semver_parser.outputs.prerelease != ''
         uses: tubone24/update_release@1cfa79ccf7422570d9a9c6b6de749ff4b280e48b

From a91fac2021d5ea88163767a11c4a8057da1fc9ab Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Thu, 10 Sep 2026 16:57:23 +0100
Subject: [PATCH 4/4] Revert "fix: Replace unmaintained ws-action-parse-semver
 with inline semver parse"

This reverts commit e94a353a062bac1e7cf0f196b084abde49be4609.
---
 .github/workflows/release_pr.yml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release_pr.yml b/.github/workflows/release_pr.yml
index 4c21eaed..05c1e910 100644
--- a/.github/workflows/release_pr.yml
+++ b/.github/workflows/release_pr.yml
@@ -26,11 +26,9 @@ jobs:
       - name: Parse semver string
         if: steps.release.outputs.release_created
         id: semver_parser
-        env:
-          TAG_NAME: ${{ steps.release.outputs.tag_name }}
-        run: |
-          prerelease="$(printf '%s' "${TAG_NAME#v}" | sed -n 's/^[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*-\([^+]*\).*$/\1/p')"
-          echo "prerelease=${prerelease}" >> "$GITHUB_OUTPUT"
+        uses: booxmedialtd/ws-action-parse-semver@7784200024d6b3fc01253e617ec0168daf603de3
+        with:
+          input_string: ${{ steps.release.outputs.tag_name }}
       - name: Mark as pre-release
         if: steps.semver_parser.outputs.prerelease != ''
         uses: tubone24/update_release@1cfa79ccf7422570d9a9c6b6de749ff4b280e48b