Use ephemeral GitHub token for updatecli

[mallendem]

Replaces the deprecated tibdex/github-app-token with Elastic's ephemeral GitHub tokens (Vault-issued, OIDC-bound) via elastic/oblt-actions/github/create-token.

This drops the long-lived OBS_AUTOMATION_APP_ID / OBS_AUTOMATION_APP_PEM App secrets entirely rather than swapping one App-secret mechanism for another. Fixes #1592. Supersedes #1659.

Requires the token policy in elastic/catalog-info#4460. That must merge first (~25 min for Backstage ingest + vault-realizer) or the 06:00 UTC cron fails with role "token-policy-28b3d130da44" could not be found.

Changes

• permissions: gains id-token: write (required for OIDC); job keeps contents: read / packages: read — the write scopes now ride on the ephemeral token rather than the job.
• actions/checkout intentionally still uses the default token: updatecli clones into its own directory and pushes with its own GITHUB_TOKEN, so the checked-out copy is read-only config.
• docker/login-action keeps secrets.GITHUB_TOKEN for the ghcr.io policy pull.
• scm.yml committer aligned to github-actions[bot]. See the caveat below.

Caveat on the committer change

With commitusingapi: true, updatecli commits via the GraphQL API and GitHub attributes the commit to the token identity — which will be elastic-vault-github-plugin-prod[bot], not github-actions[bot]. Review indicates scm.user/scm.email are only read on updatecli's native-git path, so these values are inert here (they already were: today's updatecli PRs are authored by elastic-observability-automation, never obltmachine). Happy to drop this commit if we would rather not carry a value that does not reflect reality.

Follow-ups

• Revoke the OBS_AUTOMATION_* grant in elastic/observability-github-secrets once this lands — nothing in this repo references it anymore.
• Confirm no automerge/auto-approve rule in elastic/observability-github-settings allowlists the old bot, since the PR author identity changes.

Validation

workflow_dispatch from this branch works before merge (bound_claims uses @*), so we can smoke-test end to end once #4460 is realized.

[Copilot]

Pull request overview

Updates the scheduled Updatecli automation to use Elastic’s Vault-issued, OIDC-bound ephemeral GitHub tokens instead of the deprecated tibdex/github-app-token, removing reliance on long-lived GitHub App secrets.

Changes:

• Replace tibdex/github-app-token with elastic/oblt-actions/github/create-token@v1 in the Updatecli workflow.
• Add permissions: id-token: write to enable OIDC-based token minting for the workflow.
• Align Updatecli SCM metadata values (scm.user / scm.email) to github-actions[bot].

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/updatecli.yml	Switches token issuance to Elastic’s OIDC/Vault ephemeral token action and adds id-token: write permission.
.ci/updatecli/values.d/scm.yml	Updates SCM identity fields used by Updatecli configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.