build: Ensure auto-created PRs run CI

[nzakas]

Prerequisites checklist

• I have read the contributing guidelines.

What is the purpose of this pull request?

To make the update-baseline workflow run CI when opened.

What changes did you make? (Give an overview)

I switched the workflow to use our GitHub Bot app to create the PR instead of the default workflow user. This should trigger the other workflows to run correctly.

Note: BOT_APP_PRIVATE_KEY is only enabled for this repo. To do the same thing in other repos, we'd need to add access for those repos.

Reference:
https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#triggering-further-workflow-runs

Related Issues

Is there anything you'd like reviewers to focus on?

[lumirlumir]

Thanks for taking a look at this issue!

I investigated and manually triggered the workflow on the auto-pr-fix branch, but it encountered some errors:

https://github.com/eslint/css/actions/runs/19489195700/job/55777962002

It seems there are errors like the following:

• Inputs 'owner' and 'repositories' are not set.
• Failed to create token for "css" (attempt 1): [universal-github-app-jwt] Private Key is in OpenSSH format, but only PKCS#8 is supported.

---

For other reviewers' convenience, here are some additional references:

• Authenticating with GitHub App generated tokens: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#authenticating-with-github-app-generated-tokens
• Creating pull requests in a remote repository using GitHub App generated tokens: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#creating-pull-requests-in-a-remote-repository-using-github-app-generated-tokens
• create-github-app-token Action: https://github.com/actions/create-github-app-token?tab=readme-ov-file#create-github-app-token

[lumirlumir]

I think another possible way to make the CI work would be to simply use WORKFLOW_PUSH_BOT_TOKEN, which the update-readme workflow uses:

css/.github/workflows/update-readme.yml

Line 13 in 3a0992e

workflow_push_bot_token: ${{ secrets.WORKFLOW_PUSH_BOT_TOKEN }}

Maybe the final workflow will look like this:

name: Update baseline
on:
    workflow_dispatch:
    schedule:
        - cron: "0 0 * * 0" # Runs every Sunday at midnight UTC

jobs:
    update-baseline:
# If the `WORKFLOW_PUSH_BOT_TOKEN` has `contents: write` and `pull-requests: write` permissions, it's no longer needed.
#        permissions:
#            contents: write
#            pull-requests: write    
    
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v5
            - name: Setup Node.js
              uses: actions/setup-node@v5
              with:
                  node-version: "lts/*"

            - name: Install dependencies
              run: npm install

            - name: Update baseline packages
              run: npm install -D mdn-data@latest web-features@latest

            - name: Generate baseline data
              run: npm run build:baseline

            - name: Create Pull Request
              uses: peter-evans/create-pull-request@v7
              with:
                  token: ${{ secrets.WORKFLOW_PUSH_BOT_TOKEN }}
                  commit-message: "fix: update baseline data"
                  title: "fix: update baseline data"
                  branch: update-baseline-data
                  branch-suffix: timestamp
                  body: |
                      Updates baseline data using the latest versions of mdn-data and web-features.

                      This PR is autogenerated by the "Update Baseline" GitHub Action.

---

I've tested this workflow in my forked repository: https://github.com/lumirlumir/fork-css/pulls

Before using WORKFLOW_PUSH_BOT_TOKEN: The CI is not working.

• Ref: fix: update baseline data lumirlumir/fork-css#2

After using WORKFLOW_PUSH_BOT_TOKEN: The CI is working correctly.

• Ref: fix: update baseline data lumirlumir/fork-css#6

[nzakas]

Yeah, I think that's a good suggestion. I'll update to do that.

[lumirlumir]

LGTM, thanks!

Actually, I'm not 100% sure whether it's working in the eslint/css repository, but since the following tests were successful, I'll try to merge it.

• This new workflow run was successful: https://github.com/eslint/css/actions/runs/19534873175
• The test in my forked repository was successful: lumirlumir#6

[lumirlumir]

It seems that everything is working as expected 🎉

#332