chore: use pull request based approach for changelog updates (#12497)

Author: DeepDiver1975

.github/workflows/changelog.yml

@@ -6,19 +6,19 @@ on:
     branches: [ master ]
     tags: [ "*" ]
 
+permissions: {}
+
 jobs:
   changelog:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: read
+    permissions: {}
 
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ssh-key: ${{ secrets.DEPLOYMENT_SSH_KEY }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Generate changelog
         uses: actionhippie/calens@244f3e5c328b842a740113859b87bbebf697f63b # v1.13.1
@@ -31,19 +31,22 @@ jobs:
       - name: Output
         run: cat CHANGELOG.md
 
-      - name: Publish
-        if: >
-          github.event_name == 'push' &&
-          github.ref == 'refs/heads/master' &&
-          !startsWith(github.ref, 'refs/tags/') &&
-          !startsWith(github.ref, 'refs/pull/')
-        run: |
-          git config user.name "ownClouders"
-          git config user.email "devops@owncloud.com"
-          git add CHANGELOG.md
-          if git diff --staged --quiet; then
-            echo "No changes to commit"
-            exit 0
-          fi
-          git commit -m "Automated changelog update [skip ci]"
-          git push origin master
+      - name: Generate GitHub App token
+        id: app-token
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
+        with:
+          app-id: ${{ secrets.TRANSLATION_APP_ID }}
+          private-key: ${{ secrets.TRANSLATION_APP_PRIVATE_KEY }}
+
+      - name: Create or update changelog pull request
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          branch: chore/changelog-update
+          commit-message: "chore: update changelog"
+          title: "chore: update changelog"
+          body: "Automated changelog update. This pull request is updated on each push to master — merging it will close it and a fresh one will be opened on the next change."
+          delete-branch: true
+          sign-commits: true