Open update deps PRs from galaxybot's fork

[nsoranzo]

What did you do?

• Modified the "Update dependencies" GitHub workflow to open PRs using galaxybot's Personal Access Token (which needs to be created and added as a secret by a repository admin) from its own galaxy repository fork.

Why did you make this change?

Pull requests created by an action (in this case create-pull-request) using the default GITHUB_TOKEN cannot trigger other workflows, see https://github.com/peter-evans/create-pull-request/blob/master/docs/concepts-guidelines.md#triggering-further-workflow-runs

Using a machine account like galaxybot that creates pull requests from its own fork is the most secure workaround, see https://github.com/peter-evans/create-pull-request/blob/master/docs/concepts-guidelines.md#push-pull-request-branches-to-a-fork

How to test the changes?

(select the most appropriate option; if the latter, provide steps for testing below)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. Be a repository admin
  2. Create a Personal Access Token for the galaxybot user and add it to this repository as the GALAXYBOT_PAT secret
  3. Merge and wait for Saturday :)

License

• I agree to license these contributions under Galaxy's current license.
• I agree to allow the Galaxy committers to license these and all my past contributions to the core galaxy codebase under the MIT license. If this condition is an issue, uncheck and just let us know why with an e-mail to galaxy-committers@lists.galaxyproject.org.

[jdavcs]

So now someone with admin access to the galaxybot machine account needs to set this up?

[nsoranzo]

So now someone with admin access to the galaxybot machine account needs to set this up?

Yes, exactly.

[martenson]

@nsoranzo what scope does the PAT need?

[martenson]

the secret is in place, I gave it the full repo scope as explained here: https://github.com/peter-evans/create-pull-request/blob/master/docs/concepts-guidelines.md#push-pull-request-branches-to-a-fork

[nsoranzo]

Thanks @martenson , I think that's what needed.