chore(ci): use GitHub App token to create Rust toolchain update PR

[lwshang]

Summary

• PRs opened with GITHUB_TOKEN do not trigger CI checks — a GitHub security restriction to prevent recursive workflow loops.
• Switch to the org-level GitHub App token (PR_AUTOMATION_BOT_PUBLIC_CLIENT_ID / PR_AUTOMATION_BOT_PUBLIC_PRIVATE_KEY) when calling gh pr create, so CI is triggered on the auto-created PR.

Context

• This follows the practice in infra: switch sync-motoko to pr-automation-bot-public GitHub App developer-docs#197
• chore(toolchain): update Rust to 1.95.0 #48 was created by the unfixed workflow — CI checks there are stuck in pending because the PR was opened with GITHUB_TOKEN.

Test plan

• Trigger the Update Rust Toolchain workflow manually once this merges and verify that CI checks run on the resulting PR.
  chore(toolchain): update Rust to 1.95.0 #51 was generated by dispatching the workflow from this PR branch. CI was triggered successfully. The check-repo-policies / Check Bot Policies failure there is expected — the workflow was dispatched from this PR branch, so the generated PR includes changes beyond rust-toolchain.toml.

[Copilot]

Pull request overview

Updates the Rust toolchain auto-update workflow to open PRs using a GitHub App token so that CI runs on the generated PRs (instead of being suppressed for PRs created with GITHUB_TOKEN).

Changes:

• Removes job-level GITHUB_TOKEN write permissions and introduces a GitHub App token creation step.
• Switches gh pr create authentication from secrets.GITHUB_TOKEN to the GitHub App token.
• Updates git commit author identity to the GitHub App bot.

Comments suppressed due to low confidence (1)

.github/workflows/update-rust-toolchain.yml:63

• git push origin "$BRANCH" --force will use the credentials configured by actions/checkout (typically the default GITHUB_TOKEN), not the GitHub App token you generated for gh pr create. If the goal is for the automation to act entirely as the app (and to avoid relying on GITHUB_TOKEN write perms), create the app token before checkout and pass it via actions/checkout's token: input (or otherwise configure git to use ${{ steps.app-token.outputs.token }}) so the push is authenticated with the app token as well.

          git config user.name "pr-automation-bot-public[bot]"
          git config user.email "pr-automation-bot-public[bot]@users.noreply.github.com"
          git checkout -b "$BRANCH"
          git add rust-toolchain.toml
          git commit -m "$TITLE"
          git push origin "$BRANCH" --force

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.