Use a github app token, not the default token, to run !merge_upstream workflow actions (#24822)

* Use GitHub App Token instead of built-in token

* the important token location, and simplify

* nanomap render

* Update .github/workflows/merge_upstream_master.yml

Co-authored-by: Arthri <41360489+Arthri@users.noreply.github.com>

* further updates

* formatting

---------

Co-authored-by: Arthri <41360489+Arthri@users.noreply.github.com>

.github/workflows/merge_upstream_master.yml

@@ -1,7 +1,7 @@
 name: Merge Upstream Master
 on:
   issue_comment:
-    types: [created]
+    types: created
 
 jobs:
   merge-upstream:
@@ -15,9 +15,15 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
+      - id: create_token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.PRIVATE_KEY }}
+
       - name: PR Data
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.create_token.outputs.token }}
         run: |
           pr_json=$(curl -L -s --fail-with-body -H "Authorization: token ${{ github.token }}" ${{ github.event.issue.pull_request.url }})
           if [ `jq -r '.maintainer_can_modify' <<<$pr_json` == "false" ] ; then
@@ -84,7 +90,4 @@ jobs:
 
       - name: Notify Failure
         if: failure()
-        run: |
-          curl -s -H "Authorization: token ${{ github.token }}" \
-            -X POST -d '{"body": "Merging upstream failed:\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"}' \
-            "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments"
+        run: gh pr comment ${{ github.event.issue.html_url }} -b "Merging upstream failed:\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"

.github/workflows/render_nanomaps.yml

@@ -9,19 +9,21 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   generate_maps:
-    permissions:
-      contents: write  # for Git to git push
-      pull-requests: write  # for repo-sync/pull-request to create pull requests
     name: 'Generate NanoMaps'
     runs-on: ubuntu-22.04
     steps:
+    - id: create_token
+      uses: tibdex/github-app-token@v2
+      with:
+        app_id: ${{ secrets.APP_ID }}
+        private_key: ${{ secrets.PRIVATE_KEY }}
+
     - name: 'Update Branch'
       uses: actions/checkout@v4
+      env:
+        GH_TOKEN: ${{ steps.create_token.outputs.token }}
 
     - name: Branch
       run: |
@@ -32,20 +34,11 @@ jobs:
     - name: 'Generate Maps'
       run: './tools/github-actions/nanomap-renderer-invoker.sh'
 
-    - name: 'Commit Maps'
+    - name: 'Commit Maps and open PR'
       run: |
         git config --local user.email "action@github.com"
         git config --local user.name "NanoMap Generation"
         git pull origin master
         git commit -m "NanoMap Auto-Update (`date`)" -a || true
         git push -f -u origin nanomap-render
-
-    - name: Create Pull Request
-      uses: repo-sync/pull-request@v2
-      with:
-        source_branch: "nanomap-render"
-        destination_branch: "master"
-        pr_title: "Automatic NanoMap Update"
-        pr_body: "This pull request updates the server NanoMaps. Please review the diff images before merging."
-        pr_label: "NanoMaps"
-        pr_allow_empty: false
+        gh pr create -t "Automatic NanoMap Update" -b "This pull request updates the server NanoMaps. Please review the diff images before merging." -l "NanoMaps" -H "nanomap-render" -B "master"