renovate: Use GitHub app to retrieve a token

[marcofranssen]

As Renovate will run with a different token, there is no need for specific workflow permissions anymore.

Instead the GitHub app should have sufficient permissions to create a PullRequest on the repo.

See https://github.com/actions/create-github-app-token/blob/main/README.md on instructions how to add the GitHub App.

Please note we need to configure following on the repo settings:

variable RENOVATE_APP_ID secret RENOVATE_PRIVATE_KEY

I named it specific like this so we can dedicate this app specifically to Renovate and therefore also keep permissions limited to the Renovate usecase.

We can test by rerunning the renovate workflow on this PR after we put the GitHub App and variables and secrets in place on this repo.

[wenchajun]

As Renovate will run with a different token, there is no need for specific workflow permissions anymore.

Instead the GitHub app should have sufficient permissions to create a PullRequest on the repo.

See https://github.com/actions/create-github-app-token/blob/main/README.md on instructions how to add the GitHub App.

Please note we need to configure following on the repo settings:

variable RENOVATE_APP_ID secret RENOVATE_PRIVATE_KEY

I named it specific like this so we can dedicate this app specifically to Renovate and therefore also keep permissions limited to the Renovate usecase.

We can test by rerunning the renovate workflow on this PR after we put the GitHub App and variables and secrets in place on this repo.

@benjaminhuo PTAL