ci(cargo-update-pr): open the update PR via github-sts

.github/workflows/cargo-update-pr.yml

@@ -13,15 +13,10 @@ on:
         default: "chore(deps): weekly `cargo update`"
         required: false
         type: "string"
-    secrets:
-      token:
-        description: "GITHUB_TOKEN. See https://github.com/peter-evans/create-pull-request?tab=readme-ov-file#token"
-        required: true
 
 permissions: {}
 
 env:
-  GITHUB_TOKEN: ${{ secrets.token }}
   BRANCH: cargo-update
   BODY: |
     Automation to keep dependencies in `Cargo.lock` current.
@@ -40,6 +35,15 @@ jobs:
   update:
     name: Update
     runs-on: ubuntu-latest
+    # The update branch is pushed and the PR opened with a short-lived GitHub
+    # App token minted via github-sts rather than the built-in GITHUB_TOKEN,
+    # which is not allowed to create pull requests. Callers must grant these
+    # permissions on the reusable-workflow job and carry a trust policy at
+    # .github/sts/cargo-update-pr.sts.yaml granting contents: write and
+    # pull_requests: write to their own workflow.
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -67,9 +71,18 @@ jobs:
           echo "$BODY" | envsubst >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
 
+      - name: Fetch GitHub token via STS
+        id: sts
+        uses: tempoxyz/gh-actions/actions/github-sts@183a02178c660ce295e9a262edc5857cb7135f06 # main
+        with:
+          policy: cargo-update-pr
+
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
+          token: ${{ steps.sts.outputs.token }}
+          author: tempo-github-sts[bot] <312736176+tempo-github-sts[bot]@users.noreply.github.com>
+          committer: tempo-github-sts[bot] <312736176+tempo-github-sts[bot]@users.noreply.github.com>
           add-paths: ./Cargo.lock
           commit-message: ${{ steps.msg.outputs.commit_message }}
           title: ${{ inputs.title }}