From d390eb3c897c297d665b4d63ded8ccb3d922f991 Mon Sep 17 00:00:00 2001
From: William Aaron Cheung <git@troublor.xyz>
Date: Tue, 28 Jul 2026 15:12:34 +0800
Subject: [PATCH] ci: run pr-review under the CI app identity

The shared pr-review action gates review-thread resolution on
github_identity_token being non-empty; without it the job token publishes the
review but addressed automated threads are left unresolved. Mint the CI app
token and pass it through, matching stateless-validator.
---
 .github/workflows/claude.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index be3c4ee..ffebc1a 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -67,8 +67,21 @@ jobs:
       id-token: write
       actions: read
     steps:
+      # Review under the CI app identity rather than the job token: it is what
+      # lets the action resolve stale review threads (the shared action gates
+      # --resolve-threads on github_identity_token being non-empty).
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          app-id: ${{ vars.CI_APP_ID }}
+          private-key: ${{ secrets.MEGA_CI_APP_PK }}
+          owner: megaeth-labs
+          repositories: documentation
+
       - uses: actions/checkout@v4
         with:
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
           fetch-depth: 1
 
       - name: Detect claude workflow changes
@@ -92,4 +105,5 @@ jobs:
         if: steps.workflow-change.outputs.skip != 'true'
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          github_identity_token: ${{ steps.app-token.outputs.token }}
           allowed_bots: "mega-putin"