hedgehog-botlisted

# hedgehog-bot Perform a GitHub write action (PR review, PR comment, or merge) attributed to the `hedgehog-bot` GitHub App instead of the user's personal account. ## When to use this Only when the user explicitly asks for the bot identity — "as hedgehog-bot", "as the bot", "so it shows up from the bot". Ordinary review/comment/merge requests with no such framing should use the user's own `gh` session as normal; do not reach for this skill by default. ## How it works `mint-token.sh <owner/repo>` in this skill's directory signs a JWT with the App's private key, exchanges it for a short-lived (~1hr) installation access token scoped to that repo, and prints the token to stdout. That token authenticates as `hedgehog-bot[bot]`, not the user. The private key lives at `~/.config/hedgehog-bot/private-key.pem` (mode 600) on this machine. Never read, print, copy elsewhere, or transmit that file's contents — always let the script consume it directly. ## Procedure 1. Mint a token, scoped to the target repo: ```bash TOKEN=$(.claude/skills/hedgehog-bot/mint-token.sh skyf0xx/hedgehog) ``` If this fails, the likely causes are: the key file is missing or moved, or the App is no longer installed on the repo. Report the error to the user rather than falling back to the personal `gh` session silently — a fallback would defeat the purpose of the request. 2. Use `$TOKEN` as a bearer token for the specific action, via `gh api` (not plain `gh <cmd>`, which uses t