ci/cd: use Pocket ID as identity for automated commits

.github/workflows/update-aaguids.yml

@@ -6,8 +6,7 @@ on:
   workflow_dispatch: # Allows manual triggering of the workflow
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   update-aaguids:
@@ -16,6 +15,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -25,9 +26,31 @@ jobs:
       - name: Update AAGUIDs and authenticator icons
         run: go run scripts/update-aaguids.go
 
+      - name: Create bot app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Get bot commit identity
+        id: bot
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+        run: |
+          bot_name="$APP_SLUG[bot]"
+          bot_id=$(gh api "users/$bot_name" --jq .id)
+          echo "identity=Pocket ID Bot <$bot_id+$bot_name@users.noreply.github.com>" >> "$GITHUB_OUTPUT"
+
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v7
         with:
+          token: ${{ steps.app-token.outputs.token }}
+          author: ${{ steps.bot.outputs.identity }}
+          committer: ${{ steps.bot.outputs.identity }}
           commit-message: "chore: update AAGUIDs"
           title: "chore: update AAGUIDs"
           body: |