Phase 6A: drop PAT shadow on all-citus-unit-tests build-package + migrate update_package_properties to app token

[ihalatci]

Phase 6A — drop dead org PAT on all-citus-unit-tests

Part of the migration off the retired org PAT secrets.GH_TOKEN to the cituspackagingapp GitHub App token (actions/create-github-app-token@v3, creds vars.GH_APP_ID + secrets.GH_APP_KEY, owner citusdata). The org PAT is now dead, so the two remaining references on this base branch are fixed together here.

.github/workflows/build-package.yml — shadow removal only

Removed the two top-level env shadows:

GH_TOKEN: ${{ secrets.GH_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

Safe: both jobs already mint the app token, export it to $GITHUB_ENV, and consume the exported value — nothing depends on the top-level shadow. No other change.

.github/workflows/update_package_properties.yml — full migration (unmigrated anomaly)

This workflow was still entirely on the dead PAT. Now fully on the app token:

• Deleted top-level GH_TOKEN env (kept PRJ_NAME).
• Added actions/create-github-app-token@v3 (id: app-token) as the first step.
• Checkout token: now uses ${{ steps.app-token.outputs.token }} (checkout kept at @v3).
• Added an "Export app token to environment" step writing GH_TOKEN/GITHUB_TOKEN to $GITHUB_ENV (the --gh_token="${GH_TOKEN}" call resolves via this export).
• Bumped tools pin v0.8.10 -> v0.8.36.

grep secrets.GH_TOKEN now returns zero matches on both files. Both files YAML-parse clean (PyYAML).

Validation

• build-package.yml auto-fired on push: run 28934573255 — success (https://github.com/citusdata/packaging/actions/runs/28934573255). Publish stays gated OFF because branch != MAIN_BRANCH (all-citus).
• update_package_properties.yml is workflow_dispatch-only, so not dispatched here; its structure is at parity with the already-validated all-citus version.

⛔ MERGE HELD — DRAFT for review

Do not merge / no auto-merge. Kept as a draft pending review.