Use an app to create fixture update PRs (#228)

I don't think this was supported when I first set things up, but I noticed we can now use GitHub *apps* instead of normal user accounts to create the fixture update PRs. This has all the same advantages, but is easier to manage (no extra user accounts) and lets us restrict permissions in a much more fine-grained way than is possible with classic PATs (and fine-grained PATs are not available for non-org repos). Much better!

Also adds a nicer PR description.

.github/workflows/update-fixtures.yml

@@ -44,20 +44,30 @@ jobs:
  echo 'copy_fixtures_changed=' >> "${GITHUB_OUTPUT}"
  fi
 
- - uses: crazy-max/ghaction-import-gpg@v6
+ - name: Generate commit/PR token
+ if: ${{ steps.detect_updates.outputs.copy_fixtures_changed == 'true' }}
+ id: generate-token
+ uses: actions/create-github-app-token@v1
  with:
- gpg_private_key: ${{ secrets.FIXTURE_PR_SIGNING_PRIVATE_KEY }}
- passphrase: ${{ secrets.FIXTURE_PR_SIGNING_KEY_PASS }}
- git_user_signingkey: true
- git_commit_gpgsign: true
+ app-id: ${{ secrets.FIXTURE_PR_APP_ID }}
+ private-key: ${{ secrets.FIXTURE_PR_APP_PRIVATE_KEY }}
 
  - name: Create PR
  if: ${{ steps.detect_updates.outputs.copy_fixtures_changed == 'true' }}
  uses: peter-evans/create-pull-request@v7
  with:
- token: ${{ secrets.PR_CREATION_TOKEN }}
- committer: ${{ secrets.FIXTURE_PR_SIGNING_KEY_USER }}
+ token: ${{ steps.generate-token.outputs.token }}
+ sign-commits: true
  branch: 'auto/fixture-update'
  delete-branch: true
  commit-message: 'Automated fixture update from Google Docs'
  title: 'Update Fixtures'
+ body: >
+ The clipboard data and/or exported HTML from
+ [our fixtures in Google Docs](https://drive.google.com/drive/folders/1E2hV-TBLoYBF5ma-z2KpkxLncSnP9zg5)
+ has changed. This updates the fixtures files in the repo to match the actual Google Docs.
+
+
+ *Generated by running `npm run download-fixtures` and committed via the
+ [create-pull-request](https://github.com/peter-evans/create-pull-request)
+ GitHub action.*