fix: add APP_ID and PRIVATE_KEY env vars for Safe-Settings #5

	# the-covenant/.github/workflows/enforce-covenant.yml
	name: "Enforce the Great Covenant"

	on:
	push:
	branches: ["main"]
	schedule:
	- cron: "33 03 * * *" # Nightly Vigil (UTC)

	permissions:
	contents: read
	checks: write

	jobs:
	enforce:
	# Only apply changes on push and schedule, not on PRs
	if: github.event_name != 'pull_request'
	runs-on: ubuntu-latest
	steps:
	- name: "Checkout Repository"
	uses: actions/checkout@v4

	- name: "Summon The Arbiter's Seal (App Token)"
	id: app
	uses: actions/create-github-app-token@v2
	with:
	app-id: ${{ vars.SAFE_SETTINGS_APP_ID }}
	private-key: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }}
	owner: ${{ github.repository_owner }}

	- name: "The Arbiter's Full Sync"
	env:
	GITHUB_TOKEN: ${{ steps.app.outputs.token }}
	APP_ID: ${{ vars.SAFE_SETTINGS_APP_ID }}
	PRIVATE_KEY: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }}
	ADMIN_REPO: the-covenant
	CONFIG_PATH: .github
	SETTINGS_FILE_PATH: settings.yml
	run: \|
	echo "🔮 Initiating Safe-Settings full sync..."
	git clone https://github.com/github/safe-settings.git
	cd safe-settings
	npm ci
	echo "⚔️ Enforcing The Great Covenant across the realm..."
	node full-sync.js

Provide feedback