[automation]: Update Flake dependencies

.github/workflows/update-flake-dependencies.yml

@@ -13,26 +13,33 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Generate GitHub App installation token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.FLAKE_BOT_APP_ID }}
+          private-key: ${{ secrets.FLAKE_BOT_APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
       - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
       - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
         with:
           use-flakehub: false
       - name: Update flake.lock and create signed commit with flake.lock changes
         env:
-          GITHUB_TOKEN: ${{ secrets.OP_BOT_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           FILE_TO_COMMIT: flake.lock
           COMMIT_BRANCH: automation/update-flake-dependencies
           COMMIT_MESSAGE: "chore(nix): Update Flake dependencies"
         run: |
           # fetch remote state
           git fetch
           # if branch exists on remote already
-          BRANCH_EXISTS=false
           if git checkout "$COMMIT_BRANCH" > /dev/null 2>&1; then
-            # pull changeshttps://github.com/1Password/shell-plugins/pull/595
+            # pull changes
             git pull
-            BRANCH_EXISTS=true
           else
             # otherwise, create the branch and push it to remote
             git checkout -b "$COMMIT_BRANCH"
@@ -48,11 +55,12 @@ jobs:
               --field content="$(base64 -w 0 $FILE_TO_COMMIT)" \
               --field branch="$COMMIT_BRANCH" \
               --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)"
-            if [ "$BRANCH_EXISTS" = "false" ]; then
+            OPEN_PR_COUNT=$(gh pr list --head "$COMMIT_BRANCH" --state open --json number --jq 'length')
+            if [ "$OPEN_PR_COUNT" -eq 0 ]; then
               gh pr create --title "[automation]: Update Flake dependencies" \
                 --body "This is an automated PR to update \`flake.lock\`" \
                 --label "flake.lock automation" \
-                --reviewer mrjones2014 \
+                --reviewer 1Password/open-source \
                 --base main --head $COMMIT_BRANCH
             fi
           fi