build: Switch upgrade workflow to create-pull-request action

.github/aw/actions-lock.json

@@ -1,14 +1,9 @@
 {
   "entries": {
-    "github/gh-aw-actions/setup-cli@v0.86.2": {
-      "repo": "github/gh-aw-actions/setup-cli",
-      "version": "v0.86.2",
-      "sha": "6aab9e5b5c91c615506061f09bedd81a23babe3c"
-    },
-    "github/gh-aw-actions/setup@v0.86.2": {
+    "github/gh-aw-actions/setup@v0.87.10": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.86.2",
-      "sha": "6aab9e5b5c91c615506061f09bedd81a23babe3c"
+      "version": "v0.87.10",
+      "sha": "bc8c008a419c5b7a29df6f5641edd35fd1c6ea85"
     }
   },
   "containers": {

.github/workflows/upgrade.yml

@@ -31,13 +31,13 @@ jobs:
     steps:
       - name: Generate App token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.GH_AW_APP_CLIENT_ID }}
           private-key: ${{ secrets.GH_AW_APP_PRIVATE_KEY }}
 
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ steps.app-token.outputs.token }}
 
@@ -71,42 +71,21 @@ jobs:
           gh aw compile --approve
 
       - name: Open or update a pull request with the results
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          VERSION: ${{ steps.install.outputs.version }}
-        run: |
-          set -euo pipefail
-          git add -A
-          if git diff --cached --quiet; then
-            echo "Already up to date, nothing to upgrade."
-            exit 0
-          fi
-
-          branch="automation/upgrade-gh-aw"
-          title="build: Upgrade gh-aw to ${VERSION}"
-          body="$(cat <<EOF
-          Automated upgrade, opened by \`.github/workflows/upgrade.yml\`:
-
-          - Bumped \`.github/aw/gh-aw-version\` to \`${VERSION}\`.
-          - Refreshed action-version pins in \`.github/aw/actions-lock.json\`.
-          - Recompiled all \`*.lock.yml\` files against the new version.
-
-          Safe to merge once \`check-drift\` passes; no manual review is
-          needed beyond that unless the CLI upgrade changed compiler
-          behavior in a way worth double-checking.
-          EOF
-          )"
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: "build: Upgrade gh-aw to ${{ steps.install.outputs.version }}"
+          title: "build: Upgrade gh-aw to ${{ steps.install.outputs.version }}"
+          body: |
+            Automated upgrade, opened by `.github/workflows/upgrade.yml`:
 
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -B "$branch"
-          git commit -m "$title"
-          git push --force-with-lease origin "$branch"
+            - Bumped `.github/aw/gh-aw-version` to `${{ steps.install.outputs.version }}`.
+            - Refreshed action-version pins in `.github/aw/actions-lock.json`.
+            - Recompiled all `*.lock.yml` files against the new version.
 
-          existing=$(gh pr list --head "$branch" --state open --json number --jq '.[0].number // empty')
-          if [ -n "$existing" ]; then
-            gh pr edit "$existing" --title "$title" --body "$body"
-            echo "Updated existing PR #${existing}"
-          else
-            gh pr create --title "$title" --body "$body" --head "$branch"
-          fi
+            Safe to merge once `check-drift` passes; no manual review is
+            needed beyond that unless the CLI upgrade changed compiler
+            behavior in a way worth double-checking.
+          branch: automation/upgrade-gh-aw
+          committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
+          author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"