ci: use actions/create-github-app-token (#13233)

Just use `contents:read` initial permission. The other permissions needed are
those attached to the @ohmyzsh GitHub App.

.github/workflows/dependencies.yml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: "0 6 * * 0"
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Check for updates
@@ -15,11 +18,11 @@ jobs:
         with:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
-        id: generate_token
+        id: generate-token
-        uses: ohmyzsh/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          app_id: ${{ secrets.OHMYZSH_APP_ID }}
+          app-id: ${{ secrets.OHMYZSH_APP_ID }}
-          private_key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
+          private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
@@ -27,7 +30,7 @@ jobs:
           cache: "pip"
       - name: Process dependencies
         env:
-          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
           GIT_APP_NAME: ohmyzsh[bot]
           GIT_APP_EMAIL: 54982679+ohmyzsh[bot]@users.noreply.github.com
           TMP_DIR: ${{ runner.temp }}

.github/workflows/dependencies/requirements.txt

@@ -1,4 +1,4 @@
-certifi==2025.4.26
+certifi==2025.7.14
 charset-normalizer==3.4.2
 idna==3.10
 PyYAML==6.0.2

.github/workflows/project.yml

@@ -17,13 +17,13 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Authenticate as @ohmyzsh
-        id: generate_token
+        id: generate-token
-        uses: ohmyzsh/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          app_id: ${{ secrets.OHMYZSH_APP_ID }}
+          app-id: ${{ secrets.OHMYZSH_APP_ID }}
-          private_key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
+          private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Store app token
-        run: echo "GH_TOKEN=${{ steps.generate_token.outputs.token }}" >> "$GITHUB_ENV"
+        run: echo "GH_TOKEN=${{ steps.generate-token.outputs.token }}" >> "$GITHUB_ENV"
       - name: Read project data
         env:
           ORGANIZATION: ohmyzsh