ci: configure git credentials for prerelease CDK clone

[Hweinstock]

Description

Move GitHub App token generation before npm run bundle and configure git credentials so the bundle script can clone the private agentcore-l3-cdk-constructs repo.

The bundle script runs git clone https://github.com/aws/agentcore-l3-cdk-constructs.git which fails without credentials since the repo is private. This uses the same x-access-token pattern as the e2e test workflows.

Failed run: https://github.com/aws/agentcore-cli/actions/runs/26293331790

Related Issue

N/A

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Workflow-only change — validated YAML syntax. Same x-access-token pattern proven in e2e-tests.yml and e2e-tests-full.yml.

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[github-actions]

Package Tarball

aws-agentcore-0.14.2.tgz

How to install

gh release download pr-1371-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.14.2.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-cli-automation]

LGTM. Correct fix — moves token generation and git credential configuration before npm run bundle so the script's git clone of aws/agentcore-l3-cdk-constructs is authenticated. The insteadOf approach is a clean way to authenticate the clone without modifying scripts/bundle.mjs.

One small observation (non-blocking): .github/workflows/e2e-tests.yml and e2e-tests-full.yml both set owner: aws on the create-github-app-token step when they clone the same CDK repo, but this workflow omits it. If the App's default installation scope already covers the aws org this will work fine; otherwise you may need to add owner: aws to match those workflows. Since the linked failed run will tell you immediately, happy to defer to the next run.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)