[senamakel]

Summary

• Fix the invalid build-desktop.yml that failed every push to main since feat(ci): two-branch CI — changed-files-only PR lane, full-suite release lane, release-branch cuts, cancellation watchdog #4486: the GH_TOKEN scoping change inserted a second env: key into the build job; GitHub rejects duplicate mapping keys and recorded a failed "workflow file issue" run on each push.
• Bump actions/create-github-app-token v2→v3 and dorny/paths-filter v3→v4 to move off the deprecated Node 20 runner runtime (source of the deprecation warnings in run logs).
• Incorporate the post-merge review comments from feat(ci): two-branch CI — changed-files-only PR lane, full-suite release lane, release-branch cuts, cancellation watchdog #4486: scope the release workflows' App tokens to permission-contents: write (CodeRabbit/zizmor), and add the changed-files runner scripts to the frontend/rust-core filters so a PR touching only those runners actually exercises them (Codex).

Problem

• Post-merge, every push to main produced a failed run named .github/workflows/build-desktop.yml with zero jobs — the file no longer parsed. PyYAML's lax duplicate-key handling let it pass local validation in feat(ci): two-branch CI — changed-files-only PR lane, full-suite release lane, release-branch cuts, cancellation watchdog #4486.
• create-github-app-token@v2 and paths-filter@v3 declare node20, triggering the runner's deprecation warning on every use.

Solution

• Merged GH_TOKEN into the build job's existing env: block.
• Local validation now uses a strict loader that rejects duplicate keys across all 20 workflow files (all pass).
• Version bumps to the node24-runtime majors; paths-filter@v4 output/list-files contract is unchanged.

Submission Checklist

• Tests added or updated — N/A: workflow-only fix; validated with strict YAML parse across all workflows
• Diff coverage ≥ 80% — N/A: no app/Rust source changed
• Coverage matrix updated — N/A: CI-only
• All affected feature IDs from the matrix are listed under ## Related — N/A
• No new external network dependencies introduced
• Manual smoke checklist updated — N/A
• Linked issue closed via Closes #NNN — N/A: follow-up to #4486

Impact

• Restores release build tooling (build-desktop.yml is the shared build pipeline for staging/production cuts).
• Removes node20 deprecation warnings.

Related

• Closes:
• Follow-up PR(s)/TODOs: copy XGITHUB_APP_ID/XGITHUB_APP_PRIVATE_KEY (App: tiny-humans-bot) into the Release-PR-Automation environment so prepare-release-pr can mint its token.

---

AI Authored PR Metadata (required for Codex/Linear PRs)

Linear Issue

• Key: N/A
• URL: N/A

Commit & Branch

• Branch: fix/two-branch-ci-followups

https://claude.ai/code/session_01FsaameYvpZMKZfUeWqZi7x

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates GitHub Actions workflows: repositions Telegram bot username env vars into the job env block in build-desktop.yml, and bumps action versions—dorny/paths-filter to v4 in pr-ci.yml, and actions/create-github-app-token to v3 in prepare-release-pr.yml, release-production.yml, and release-staging.yml.

Changes

CI Workflow Updates

Layer / File(s)	Summary
Env block correction .github/workflows/build-desktop.yml	Moves OPENHUMAN_TELEGRAM_BOT_USERNAME and VITE_TELEGRAM_BOT_USERNAME into the job-level env: block alongside GH_TOKEN, sourced from inputs.telegram_bot_username.
Action version bumps .github/workflows/pr-ci.yml, .github/workflows/prepare-release-pr.yml, .github/workflows/release-production.yml, .github/workflows/release-staging.yml	Updates dorny/paths-filter from v3 to v4, and actions/create-github-app-token from v2 to v3 in three workflows.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: bug

Suggested reviewers: sanil-23, M3gA-Mind

Poem

A hop, a skip, a version bump,
Env vars land with a tidy thump,
v2 to v3, filters anew,
CI carrots crunching through,
This rabbit ships a clean release! 🐇🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main fixes: the build-desktop workflow parse issue and the action/runtime version bumps.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release-production.yml:
- Around line 120-125: The Generate GitHub App token step currently mints a
token with the app’s full installation permissions, which is broader than this
release job needs. Update the actions/create-github-app-token@v3 usage in the
app-token step to add the same least-privilege permission scoping pattern used
in prepare-release-pr.yml, specifically limiting the token to the contents and
pull request permissions required for pushing release/main updates and creating
tags.

In @.github/workflows/release-staging.yml:
- Around line 95-100: The GitHub App token generated in the release-staging
workflow is inheriting broad installation permissions instead of least
privilege. Update the Generate GitHub App token step in the release-staging
workflow to pass the appropriate permission-scoping inputs on
actions/create-github-app-token@v3, limiting it to only the contents: write
access needed for the version-bump commit and tag push.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 18d2588e-22c9-46fe-ae39-2616b8a516c8

📥 Commits

Reviewing files that changed from the base of the PR and between 5b15bbc and 91728b8.

📒 Files selected for processing (5)

• .github/workflows/build-desktop.yml
• .github/workflows/pr-ci.yml
• .github/workflows/prepare-release-pr.yml
• .github/workflows/release-production.yml
• .github/workflows/release-staging.yml