Set up CanastaWiki GitHub App for cross-repo release mirror (post-rename)

[cicalese]

Goal

Set up a CanastaWiki-org-owned GitHub App so the post-rename Canasta-Go release workflow can mirror v3.7.0 artifacts to the post-rename Canasta-CLI repo. Required for #741 to actually fire the cross-repo mirror step.

Why

After the rename (current CanastaWiki/Canasta-CLI → Canasta-Go; current CanastaWiki/Canasta-Ansible → Canasta-CLI), legacy 3.x clients running canasta upgrade query https://api.github.com/repos/CanastaWiki/Canasta-CLI/releases/latest. The new Canasta-CLI repo (formerly Canasta-Ansible) ships 4.x via packages, not GitHub releases, so that endpoint would return no data and legacy upgrades would fail.

#741 adds a workflow step in Canasta-Go that mirrors the v3.7.0 release into the new Canasta-CLI repo. Cross-repo writes need credentials valid for the target — the default GITHUB_TOKEN is scoped to the running repo only.

Pre-rename or post-rename?

Either works. GitHub App installations are tied to the repo's internal numeric ID, not its name, so installing on CanastaWiki/Canasta-CLI and CanastaWiki/Canasta-Ansible now (before the renames) means those installations follow the renamed repos automatically — no post-rename re-install needed. Doing this pre-rename also shrinks the post-rename window where the new Canasta-CLI repo has no releases yet.

What to set up (org-owner only — must be a CanastaWiki org owner)

Step 1 — Create the App

1. Go to https://github.com/organizations/CanastaWiki/settings/apps.
2. Click New GitHub App.
3. Fill in:
   • GitHub App name: canasta-release-mirror (must be globally unique on GitHub; if taken, try canastawiki-release-mirror).
   • Homepage URL: https://github.com/CanastaWiki or https://canasta.wiki.
   • Webhook → Active: uncheck. Webhooks aren't needed; the App is only used to mint tokens at workflow runtime.
   • Repository permissions → Contents: Read and write. Leave all other permissions at the default No access.
   • Where can this GitHub App be installed? Only on this account (CanastaWiki).
4. Click Create GitHub App.
5. On the next page, scroll to Private keys and click Generate a private key. A .pem file downloads — save it; the contents go into the org secret in step 4.
6. Note the App ID at the top of the page (a numeric ID like 123456). Goes into the org variable in step 3.

Step 2 — Install the App on both repos

1. In the App's settings, click Install App in the left sidebar.
2. Find CanastaWiki in the list and click Install.
3. Choose Only select repositories and select both:
   • CanastaWiki/Canasta-CLI
   • CanastaWiki/Canasta-Ansible
4. Click Install.

The installation persists across the renames. After both renames, the same installation will be on Canasta-Go and Canasta-CLI (new) respectively.

Step 3 — Set the org variable

1. Go to https://github.com/organizations/CanastaWiki/settings/variables/actions.
2. Click New organization variable.
3. Fill in:
   • Name: RELEASE_BOT_APP_ID
   • Value: the numeric App ID from step 1.6.
   • Repository access: All repositories (simplest; only Canasta-Go actually reads it, but having it visible to the rest of the org is harmless).
4. Click Add variable.

Step 4 — Set the org secret

1. Go to https://github.com/organizations/CanastaWiki/settings/secrets/actions.
2. Click New organization secret.
3. Fill in:
   • Name: RELEASE_BOT_PRIVATE_KEY
   • Value: the full contents of the .pem file from step 1.5, including the -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- lines. Copy the entire file as-is.
   • Repository access: All repositories (same reasoning as the variable).
4. Click Add secret.

Step 5 — Sanity check

You can't actually exercise the mirror until the rename + Phase 6 run, but you can confirm the pieces are in place:

1. https://github.com/organizations/CanastaWiki/settings/apps → click the App → Installations in the left sidebar → CanastaWiki gear icon. Confirm both Canasta-CLI and Canasta-Ansible appear under Repository access.
2. In the App's Permissions & events tab, confirm Contents shows Read and write.
3. Settings → Variables → Actions at the org level — RELEASE_BOT_APP_ID is listed.
4. Settings → Secrets → Actions at the org level — RELEASE_BOT_PRIVATE_KEY is listed.

Acceptance

• https://api.github.com/repos/CanastaWiki/Canasta-CLI/releases/latest returns tag_name: v3.7.0 with the four binary assets attached, after the first VERSION bump post-rename.
• Legacy canasta upgrade from a 3.6.x client successfully self-updates to 3.7.0.

Sequencing

The App can be set up at any point before Phase 6 (the VERSION bump that triggers the release). Doing it pre-rename minimizes the post-rename "no releases yet" window.

1. This issue — set up the App.
2. Close Add Go-to-Ansible bridge program for v3.7.0 release #740 without merging.
3. Rename CanastaWiki/Canasta-CLI → Canasta-Go.
4. Rename CanastaWiki/Canasta-Ansible → Canasta-CLI.
5. Land Add deprecation warning and cross-repo release mirror (replaces #740) #741 in Canasta-Go (won't fire the mirror — VERSION unchanged).
6. Bump VERSION in Canasta-Go to 3.7.0. Workflow fires; mirror lands v3.7.0 in Canasta-CLI.