Fix the sync-secret-scanning workflow to enable automerge without human intervention (#61528)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mchammer01 <42146119+mchammer01@users.noreply.github.com>

Author: Copilot

.github/workflows/sync-secret-scanning.yml

@@ -37,61 +37,44 @@ jobs:
         run: |
           npm run sync-secret-scanning
 
-      - name: Create a pull request
+      - name: Create pull request
+        id: create-pull-request
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # pin @v8.0.0
         env:
-          # Needed for gh
-          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
-        run: |
-          # If nothing to commit, exit now. It's fine.
-          changes=$(git diff --name-only | wc -l)
-          untracked=$(git status --untracked-files --short | wc -l)
-          if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then
-            echo "There are no changes to commit. Exiting..."
-            exit 0
-          fi
-
-          git config --global user.name "docs-bot"
-          git config --global user.email "77750099+docs-bot@users.noreply.github.com"
-
-          branchname=sync-secret-scanning-`date +%Y%m%d%H%M%S`
-
-          remotesha=$(git ls-remote --heads origin $branchname)
-          if [ -n "$remotesha" ]; then
-            # output is not empty, it means the remote branch exists
-            echo "Branch $branchname already exists in 'github/docs-internal'. Exiting..."
-            exit 0
-          fi
-
-          git checkout -b $branchname
-          git add .
-          git commit -m "Add updated secret scanning data"
-          git push origin $branchname
-
-          echo "Creating pull request..."
-          gh pr create \
-            --title "Sync secret scanning data" \
-            --body '👋 humans. This PR updates the secret scanning data with the latest changes from github/token-scanning-service.
+          # Disable pre-commit hooks; they don't play nicely here
+          HUSKY: '0'
+        with:
+          # need to use a token with repo and workflow scopes for this step
+          token: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          commit-message: 'Add updated secret scanning data'
+          title: Sync secret scanning data
+          body: |
+            👋 humans. This PR updates the secret scanning data with the latest changes from github/token-scanning-service.
 
             If CI passes, this PR will be auto-merged. :green_heart:
 
-            If CI does not pass or other problems arise, contact #docs-engineering on Slack.' \
-            --repo github/docs-internal \
-            --label secret-scanning-pipeline,'skip FR board',workflow-generated \
-            --head=$branchname
+            If CI does not pass or other problems arise, contact #docs-engineering on Slack.
+
+            This automated PR was created by [this workflow](https://github.com/github/docs-internal/blob/main/.github/workflows/sync-secret-scanning.yml).
+          branch: sync-secret-scanning-data
+          labels: |
+            secret-scanning-pipeline
+            skip FR board
+            workflow-generated
 
-          # can't approve your own PR, approve with Actions
-          echo "Approving pull request..."
-          unset GITHUB_TOKEN
-          gh auth login --with-token <<< "${{ secrets.GITHUB_TOKEN }}"
-          gh pr review --approve
-          echo "Approved pull request"
+      - name: Enable GitHub auto-merge
+        if: ${{ steps.create-pull-request.outputs.pull-request-number }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          AUTOMERGE_PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
+        run: npm run enable-automerge
 
-          # Actions can't merge the PR so back to docs-bot to merge
-          echo "Setting pull request to auto merge..."
-          unset GITHUB_TOKEN
-          gh auth login --with-token <<< "${{ secrets.DOCS_BOT_PAT_BASE }}"
-          gh pr merge --auto --merge
-          echo "Set pull request to auto merge"
+      - if: ${{ steps.create-pull-request.outputs.pull-request-number }}
+        name: Approve
+        uses: juliangruber/approve-pull-request-action@dcc4effb325c0b503408619918d56e40653dcc91
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          number: ${{ steps.create-pull-request.outputs.pull-request-number }}
 
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() && github.event_name != 'workflow_dispatch' }}