[thdxr]

generate.yml and nix-hashes.yml on v1 fail with appId option is required because OPENCODE_APP_ID and OPENCODE_APP_SECRET were removed. This switches v1 to the same mechanism dev uses, which needs only GITHUB_TOKEN.

Nix hashes: same as dev #59464

• nix-hashes.yml becomes bot-nix-hashes.yml, copied from dev. The hash and compute jobs use a read-only token and no secrets. publish (contents, pull-requests and actions write) runs only .github/nix-hashes/publish.sh from the triggering commit. It commits only a validated nix/hashes.json to bot/v1-nix-hashes, opens or updates the PR into v1, dispatches typecheck.yml, test.yml, nix-eval.yml and check-bot-scope.yml on the branch, and runs gh pr merge --auto --squash.
• check-bot-scope.yml and .github/nix-hashes/validate.sh are copied from dev. The check fails bot/v1-nix-hashes unless it changes only a valid nix/hashes.json.
• Differences from dev: the branch is v1, the bot branch is bot/v1-nix-hashes, the path filters match v1 (no services/*), and the concurrency group is v1-specific.

Generate: same as dev

Dev removed its generate bot (15f0fc9) and checks generated files in pull requests instead. generate.yml is removed here, and typecheck.yml gets a generated job. It runs ./script/generate.ts (SDK build, OpenAPI and prettier) and fails if that changes anything. v1 is currently clean under it.

Removed

• generate.yml.
• docs-locale-sync.yml: it only triggers on pushes to dev, and dev doesn't have this file, so it never runs.
• models-snapshot.yml: it is scheduled, so it runs from dev, where the file doesn't exist. It also targets v2.
• .github/actions/setup-git-committer.

No v1 workflow references OPENCODE_APP_ID, OPENCODE_APP_SECRET or actions/create-github-app-token anymore.

Before the bot can merge on v1 (ruleset 25933885, not changed here)

The update rule only lets bypass actors change v1, and github-actions isn't one. Until that changes, publish opens or updates the PR, then fails at gh pr merge. The PR stays open for someone to merge.

v1 also has no required status checks, so check-bot-scope wouldn't gate auto-merge. Both changes are needed together:

1. Require the bot-scope check (GitHub Actions app, integration 15368) on refs/heads/v1 in a separate ruleset that has no github-actions bypass. A bypass on 25933885 would also skip its own rules.
2. Add the GitHub Actions app (Integration, actor_id 15368) to 25933885's bypass list with bypass_mode: "pull_request", so it can only merge through a pull request.

Auto-merge is already enabled for the repository.

Checks

• actionlint before: 27 unknown blacksmith-* labels plus 2 findings, both in the deleted docs-locale-sync.yml and generate.yml. After: 24 unknown labels and nothing else.
• bash -n passes on publish.sh and validate.sh, and validate.sh accepts v1's nix/hashes.json.
• ./script/generate.ts leaves v1 unchanged.