ci(workflows): use GitHub App token for trusted stack stats PRs

Author: nozomee

.github/workflows/update-trusted-stack-stats.yml

@@ -6,6 +6,8 @@ on:
     - cron: '0 6 * * 1'
   workflow_dispatch:
 
+permissions: {}
+
 defaults:
   run:
     shell: bash
@@ -15,8 +17,7 @@ jobs:
     if: github.repository == 'voidzero-dev/vite-plus' && github.event.repository.fork == false
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -31,13 +32,20 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: node docs/.vitepress/theme/data/fetch-trusted-stack-stats.ts
 
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        id: app-token
+        with:
+          client-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Create or update PR
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           base: main
           branch: chore/docs-trusted-stack-stats
           title: 'chore(docs): refresh trusted stack stats'
-          token: ${{ secrets.GITHUB_TOKEN }}
+          sign-commits: true
+          token: ${{ steps.app-token.outputs.token }}
           commit-message: 'chore(docs): refresh trusted stack stats'
           add-paths: |
             docs/.vitepress/theme/data/trusted-stack-stats.json