refac

.github/workflows/docker.yaml

@@ -235,25 +235,20 @@ jobs:
     runs-on: ubuntu-latest
     needs: [merge]
     if: ${{ !cancelled() && needs.merge.result == 'success' && (github.ref == 'refs/heads/dev' || startsWith(github.ref, 'refs/tags/v')) }}
-    env:
-      HELM_CHARTS_DISPATCH_TOKEN: ${{ secrets.HELM_CHARTS_DISPATCH_TOKEN }}
     steps:
-      - name: Check dispatch token
-        id: token
-        run: |
-          if [ -z "${HELM_CHARTS_DISPATCH_TOKEN}" ]; then
-            echo "::warning::HELM_CHARTS_DISPATCH_TOKEN is not configured; skipping Helm chart automation dispatch."
-            echo "present=false" >> "${GITHUB_OUTPUT}"
-          else
-            echo "present=true" >> "${GITHUB_OUTPUT}"
-          fi
+      - name: Create Helm charts app token
+        id: helm-app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.HELM_CHARTS_APP_ID }}
+          private-key: ${{ secrets.HELM_CHARTS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: helm-charts
 
       - name: Set up Docker Buildx
-        if: steps.token.outputs.present == 'true'
         uses: docker/setup-buildx-action@v3
 
       - name: Verify published Open WebUI image
-        if: steps.token.outputs.present == 'true'
         id: image
         run: |
           set -euo pipefail
@@ -271,10 +266,9 @@ jobs:
           echo "tag=${image_tag}" >> "${GITHUB_OUTPUT}"
 
       - name: Dispatch Helm chart automation
-        if: steps.token.outputs.present == 'true'
         uses: actions/github-script@v8
         with:
-          github-token: ${{ secrets.HELM_CHARTS_DISPATCH_TOKEN }}
+          github-token: ${{ steps.helm-app-token.outputs.token }}
           script: |
             const isDev = context.ref === 'refs/heads/dev';
             const eventType = isDev