Fix Drift: authenticate via copilotkit-devops-bot app token

.github/workflows/fix-drift.yml

@@ -28,6 +28,14 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
+      - name: Mint app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: "1108748"
+          private-key: ${{ secrets.DEVOPS_BOT_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -136,14 +144,14 @@ jobs:
         if: steps.autofix.outcome == 'success' && success() && steps.check.outputs.skip != 'true'
         run: git config --local url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
         env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ steps.app-token.outputs.token }}
 
       # Step 5: Create PR on success
       - name: Create PR
         id: pr
         if: steps.autofix.outcome == 'success' && success() && steps.check.outputs.skip != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           npx tsx scripts/fix-drift.ts --create-pr
           PR_URL=$(gh pr list --head "$(git branch --show-current)" --json url --jq '.[0].url')
@@ -154,9 +162,34 @@ jobs:
       - name: Auto-merge PR
         if: success() && steps.pr.outputs.url != ''
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           PR_URL: ${{ steps.pr.outputs.url }}
-        run: gh pr merge "$PR_URL" --merge --auto
+        run: |
+          # Wait for CI to register and pass before merging. A ruleset bypass
+          # actor bypasses the entire ruleset, so the green gate must live here,
+          # not in branch protection. `gh pr checks --watch` blocks until all
+          # checks complete and exits non-zero if any fail; --fail-fast bails on
+          # first failure. Treat "no checks" as NOT-green: require at least one.
+          #
+          # First poll until at least one check is registered (up to ~5 min).
+          count=0
+          for i in $(seq 1 10); do
+            count=$(gh pr checks "$PR_URL" 2>/dev/null | wc -l)
+            if [ "$count" -gt 0 ]; then
+              echo "CI checks registered ($count rows), proceeding to watch"
+              break
+            fi
+            echo "No checks registered yet (attempt $i/10), waiting 30s..."
+            sleep 30
+          done
+          if [ "$count" -eq 0 ]; then
+            echo "::error::No CI checks ever registered — not merging"
+            exit 1
+          fi
+          gh pr checks "$PR_URL" --watch --fail-fast --interval 30 || {
+            echo "::error::CI checks failed or none present — not merging"; exit 1;
+          }
+          gh pr merge "$PR_URL" --merge
 
       # Step 7: Slack notification on successful fix
       - name: Notify Slack on fix success