fix: use a GitHub App token in the GeoLite update workflow

[abhalsod-sonata]

Description

The "Update GeoLite Database" workflow has failed since 2026-10-01 (run 36809399679). gh pr create uses the GH_PAT_WITH_ORG secret, a personal access token whose owner account has been deactivated:

pull request create failed: GraphQL: must be a collaborator (createPullRequest)

SRE is moving away from personal access tokens and is creating a GitHub App for this workflow instead (DOS-7368). This PR switches the workflow to that App:

• A new "Generate GitHub App token" step uses actions/create-github-app-token@v3 to exchange the App credentials for a short-lived installation token scoped to this repository.
• gh pr create now uses that token instead of GH_PAT_WITH_ORG.
• The branch push is unchanged and still uses the job's GITHUB_TOKEN.

Impacted roles: Developer / Operator (CI only, no runtime change).

GitHub App (requested in DOS-7368)

• Proposed name: edx-platform-geolite-updater (final name is up to SRE)
• Installed on edx/edx-platform only, no webhook
• Repository permissions: Contents: Read and write, Pull requests: Read and write, Metadata: Read
• Organization permissions: Members: Read, needed to request the edx/orbi-bom team as reviewer

SRE adds the App credentials directly as repository secrets in this repo. They are not shared outside GitHub (no Keeper, email or direct message).

• GH_APP_CLIENT_ID: the App's Client ID (create-github-app-token@v3 uses client-id; app-id is deprecated)
• GH_APP_PRIVATE_KEY: the App's private key

Merge plan

1. Merge only after SRE confirms on DOS-7368 that both secrets are added. Until then the new step fails, the same way the workflow fails today.
2. After merge, run the workflow manually (see Testing instructions).
3. Once the run succeeds, report back on DOS-7368 so SRE can delete the old GH_PAT_WITH_ORG secret.

Supporting information

• Jira (private): LP-1331, DOS-7368
• Failing run: https://github.com/edx/edx-platform/actions/runs/36809399679
• Related: fix: make GeoLite update workflow rerun-safe and fix shell quoting #501 (rerun and quoting fixes in the same workflow). The two PRs touch different lines and merge cleanly in either order.
• SRE guide (private): GSREKB Confluence page "GitHub", section "Exchanging the Key for a Token Using GitHub Actions"

Testing instructions

1. Confirm GH_APP_CLIENT_ID and GH_APP_PRIVATE_KEY exist under Settings > Secrets and variables > Actions.
2. After merge, run the workflow manually:
   gh workflow run update-geolite-database.yml -R edx/edx-platform --ref release-ulmo
3. Check that the "Generate GitHub App token" step passes and that the run opens a PR authored by the App (<app-name>[bot]) with edx/orbi-bom requested as reviewer.

Deadline

Before the next scheduled run on 2026-11-01.

[abhalsod-sonata]

Converting to draft until SRE creates the GitHub App and adds the GH_APP_CLIENT_ID and GH_APP_PRIVATE_KEY repository secrets (DOS-7368). Until then the new token step would fail.

Merge order

1. fix: make GeoLite update workflow rerun-safe and fix shell quoting #501: rerun and quoting fixes. Already approved.
2. fix: use a GitHub App token in the GeoLite update workflow #508 (this PR): merge after fix: make GeoLite update workflow rerun-safe and fix shell quoting #501. If GitHub reports this branch is out of date, update it from release-ulmo first. There are no conflicts.

After both are merged, run the workflow manually and confirm it opens a PR authored by the App:
gh workflow run update-geolite-database.yml -R edx/edx-platform --ref release-ulmo