docs: update GitHub App docs to use client-id

[Wuodan]

Update the README examples for actions/create-github-app-token@v3 to use client-id.

Prevents this warning:
Warning: Input 'app-id' has been deprecated with message: Use 'client-id' instead.

See actions/create-github-app-token#353

[Wuodan]

I just noticed that bulk-github-repo-settings-sync-action-live-tests uses variables not secret for APP_ID and also prepends vars/secrets with LIVE_TEST_ (probably to avoid confusion when those tests where in this action repo).

PR coming in the live tests repo ...

[joshjohanning]

Ahh, good point @Wuodan! I see there's a bit of inconsistency here in our docs.

In that case, let's just go with what the create-github-app-token uses to be consistent:

  client-id: ${{ vars.GITHUB_APP_CLIENT_ID }} # INVALID
  private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} # INVALID

[joshjohanning]

The action's docs are bad, vars and secrets can't start with GITHUB_

Variable name cannot start with "GITHUB_" prefix.

I haven't decided if I like CLIENT_ID or APP_CLIENT_ID. I think CLIENT_ID like you have it since it's just PRIVATE_KEY otherwise.

[Wuodan]

https://github.com/actions/create-github-app-token/blob/1b10c78c7865c340bc4f6099eb2f838309f1e8c3/.github/workflows/test.yml#L48

In the tests of actions/create-github-app-token, other var names or secret names are used:

        with:
          app-id: ${{ vars.TEST_APP_ID }}
          private-key: ${{ secrets.TEST_APP_PRIVATE_KEY }}

So those names in the docs seem to be ment as samples. But I agree that those docs might be confusing or lead to trial and error for many users.

[Wuodan]

joshjohanning/bulk-github-repo-settings-sync-action-live-tests#19

Updates the live-tests to what the action documents with this PR here:

          client-id: ${{ secrets.CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

secrets.PRIVATE_KEY would also work, I ran a test.

And I would just leave it at that (or if anything rename APP_PRIVATE_KEY to PRIVATE_KEY).

Most users of this action will just copy the sample and have a syn-repo running the action with some config files (like dependabot.yml, etc.) and some glue like you and I have. And this only needs one GH app and thus no extra prefix to var and secret names.
Users having a complex setup with several GH apps are competent enough to prefix themselves what's needed.

[Copilot]

Pull request overview

Updates the README’s GitHub App authentication examples to use the non-deprecated client-id input for actions/create-github-app-token@v3, avoiding the deprecation warning for app-id.

Changes:

• Replace app-id with client-id in README workflow examples.
• Update the setup instructions to store the GitHub App Client ID as a repository variable (APP_CLIENT_ID) instead of a secret.

Show a summary per file

File	Description
README.md	Updates GitHub App token generation examples/instructions to use client-id + ${{ vars.APP_CLIENT_ID }} to match the upstream deprecation.

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 0

[joshjohanning]

Thanks @Wuodan! I changed this one and joshjohanning/bulk-github-repo-settings-sync-action-live-tests#19 to use vars.APP_CLIENT_ID and secrets.APP_PRIVATE_KEY to match the names of the vars/secrets in the upstream action now- https://github.com/actions/create-github-app-token (because I like consistency 😁 )

[joshjohanning]

And in my opinion, the client ID is not a secret (it's a var), so having it exposed as a var instead of a secret is EASIER to know which exact app you're referencing and easier to thus change it if you have to.