Automate verified content updates (#93)

## Summary
- create scheduled-update pull requests with the dedicated
PowerShell.org Automation GitHub App
- add a privileged, PR-only merger that runs only after `Build Hugo
Site` succeeds
- verify the PR was created by the configured app and still points at
the tested commit before merging

## Security
The merger never checks out pull-request code. It accepts only the three
fixed automation branches, same-repository PRs, and the GitHub App bot
as author.

## Verification
- rebased on `origin/main`
- parsed and validated all eight workflow configurations

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: HeyItsGilbert

.github/workflows/community-stats.yml

@@ -6,8 +6,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   update-community:
@@ -27,9 +26,17 @@ jobs:
       - name: Fetch Discourse activity
         run: node .github/scripts/fetch-discourse-activity.js
 
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.AUTOMATION_APP_CLIENT_ID }}
+          private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
+
       - name: Create pull request for updated community stats
         uses: peter-evans/create-pull-request@v8.1.1
         with:
+          token: ${{ steps.app-token.outputs.token }}
           add-paths: data/community_stats.json
           branch: automation/update-community-stats
           commit-message: Update community stats

.github/workflows/meetup-sync.yml

@@ -6,8 +6,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 concurrency:
   group: sync-meetup-events
@@ -28,9 +27,17 @@ jobs:
       - name: Sync upcoming Meetup events
         run: node .github/scripts/sync-meetup-events.mjs
 
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.AUTOMATION_APP_CLIENT_ID }}
+          private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
+
       - name: Create pull request for synchronized events
         uses: peter-evans/create-pull-request@v8.1.1
         with:
+          token: ${{ steps.app-token.outputs.token }}
           add-paths: |
             content/calendar
           branch: automation/sync-meetup-events

.github/workflows/merge-automation-prs.yml

@@ -0,0 +1,45 @@
+name: Merge Verified Automation Pull Requests
+
+on:
+  workflow_run:
+    workflows: [Build Hugo Site]
+    types: [completed]
+
+permissions:
+  contents: read
+
+jobs:
+  merge:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      (github.event.workflow_run.head_branch == 'automation/update-community-stats' ||
+      github.event.workflow_run.head_branch == 'automation/sync-meetup-events' ||
+      github.event.workflow_run.head_branch == 'automation/sync-podcast')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.AUTOMATION_APP_CLIENT_ID }}
+          private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
+
+      - name: Merge the verified automation pull request
+        env:
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          pull_request=$(gh pr view "$HEAD_BRANCH" --repo "$GITHUB_REPOSITORY" --json number,headRefOid,author,baseRefName,state)
+          test "$(jq -r '.author.login' <<<"$pull_request")" = "${APP_SLUG}[bot]"
+          test "$(jq -r '.baseRefName' <<<"$pull_request")" = main
+          test "$(jq -r '.state' <<<"$pull_request")" = OPEN
+          test "$(jq -r '.headRefOid' <<<"$pull_request")" = "$HEAD_SHA"
+          gh pr merge "$(jq -r '.number' <<<"$pull_request")" \
+            --repo "$GITHUB_REPOSITORY" \
+            --squash \
+            --delete-branch \
+            --match-head-commit "$HEAD_SHA"

.github/workflows/podcast-sync.yml

@@ -9,8 +9,7 @@ on:
 # episode could roll off the feed. See docs/adr/0003-incremental-podcast-sync.md.
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   sync-podcast:
@@ -30,9 +29,17 @@ jobs:
       - name: Sync podcast feed
         run: node .github/scripts/sync-podcast-feed.js
 
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.AUTOMATION_APP_CLIENT_ID }}
+          private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
+
       - name: Create pull request for new episodes
         uses: peter-evans/create-pull-request@v8.1.1
         with:
+          token: ${{ steps.app-token.outputs.token }}
           add-paths: |
             content/podcast
           branch: automation/sync-podcast