[dpfaffenbauer]

The upmerge workflow pushed and opened its pull requests with GITHUB_TOKEN. That causes two problems:

1. Workflow changes are refused. GITHUB_TOKEN never gets the workflows permission, so any upmerge that carries a change to .github/workflows/* fails at the push (e.g. run 42791527217; [UPMERGE] 5.1 -> 2026.x #3283, [UPMERGE] 5.0 -> 5.1 #3292 and [UPMERGE] 5.1 -> 2026.x #3293 had to be done by hand).
2. No CI on upmerge PRs. Events caused by GITHUB_TOKEN start no workflows. [UPMERGE] 5.1 -> 2026.x #3289 got only 2 checks, so the required checks of the "Version Branches" ruleset never report and upmerge PRs can only be merged via bypass.

The workflow now creates a coreshop-bot app token from the existing STUDIO_BUILD_APP_ID / STUDIO_BUILD_APP_PRIVATE_KEY secrets (the app that already commits the Studio builds, with contents, pull_requests and workflows write) and passes it to create-pull-request. If the token step fails, it falls back to GITHUB_TOKEN.

The merge commit is still authored as github-actions[bot], so the check for commits by others on an existing upmerge branch keeps working.

After the merge: run the workflow once via workflow_dispatch to verify.

[coreshop-bot]

🚦 PR Guardrail

⚠️ Advisory mode: this PR is not blocked (yet). Once the guardrail is switched to enforce: true, the points below would be violations.

Rule	Check	Result
R1	Branch name	❌ failed
R2	Linked issue	❌ failed
R3	Title	✅ passed
R4	Description	✅ passed
R5	CI	⏳ pending (checks still running)
R6	Closing reference	❌ failed
R7	Base branch	✅ passed
R8	Release milestone	➖ skipped (only for release PRs)

❌ R1 — Branch name

Branch ci/upmerge-app-token does not follow the issue/<number> scheme.

➡️ Rename the branch to issue/<issue-number> (e.g. issue/123 or issue/123-dam-import) and reopen the PR. The number must point to an issue in this repository.

❌ R2 — Linked issue

The branch name carries no issue number, so the PR is not linked to an issue.

➡️ Name the branch after an open issue of this repository (see R1). Create the issue first if there is none yet.

❌ R6 — Closing reference

The PR body does not close any issue (Closes #<number>), and the guardrail can only add the reference once the PR is linked to a valid issue (R1/R2).

➡️ Fix R1/R2 and the reference is appended automatically, or add Closes #<number> to the PR body.

ℹ️ Some CI checks are still running. The CI result is re-evaluated automatically once they finish.

_{Automated comment by the PR guardrail — details and FAQ: docs/GUARDRAILS.md in coreshop/workflow-collection.}