Merge pull request #21133 from calixteman/sync_l10n_app

Use a gh app for making the PR to update l10n data

.github/workflows/update_locales.yml

@@ -6,19 +6,27 @@ on:
   workflow_dispatch: # Allow manual triggering
 
 permissions:
-  contents: write
+  contents: read
-  pull-requests: write
 
 jobs:
   update-locales:
     name: Update locales
     runs-on: ubuntu-latest
+    environment: sync_l10n
 
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ secrets.CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          persist-credentials: true
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
 
       - name: Use Node.js LTS
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
@@ -34,7 +42,7 @@ jobs:
 
       - name: Create Pull Request
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           if [ -z "$(git status --porcelain l10n/)" ]; then
             echo "No locale changes to commit."
@@ -42,6 +50,7 @@ jobs:
           fi
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}"
           git switch -C update-locales
           git add l10n/
           git commit -m "l10n: Update locale files"