devops: fix roll automation

.github/workflows/azure-static-web-apps-delightful-forest-0a29f6210.yml

@@ -70,22 +70,3 @@ jobs:
         name: playwright-report
         path: playwright-report/
         retention-days: 30
-
-  auto-merge:
-    name: Auto Merge
-    runs-on: ubuntu-latest
-    needs: [build_and_deploy_job, test]
-    if: github.repository == 'microsoft/playwright.dev' && startsWith(github.head_ref, 'roll/next-')
-    steps:
-      - name: Merge pull request
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
-          script: |
-            await github.rest.pulls.merge({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.payload.pull_request.number,
-              merge_method: 'squash',
-              commit_message: '',
-            });

.github/workflows/roll-next.yml

@@ -5,13 +5,12 @@ on:
     # Every day at 10:05 UTC
     - cron: "5 10 * * *"
 
-permissions:
-  contents: write 
-
 jobs:
   roll-docs:
     name: Roll Playwright to ToT
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/checkout@v4
@@ -49,11 +48,16 @@ jobs:
           git add .
           git commit -m "feat(roll): roll to ToT Playwright ($(date +"%d-%m-%y"))"
           git push origin $BRANCH_NAME --force
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.PLAYWRIGHT_APP_ID }}
+          private-key: ${{ secrets.PLAYWRIGHT_PRIVATE_KEY }}
       - name: Create Pull Request
         uses: actions/github-script@v7
         if: ${{ steps.prepare-branch.outputs.HAS_CHANGES == '1' }}
         with:
-          github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             await github.rest.pulls.create({
               owner: 'microsoft',

.github/workflows/roll-stable.yml

@@ -69,11 +69,16 @@ jobs:
           git add "**/versions.json"
           git commit -m "feat(roll): roll to $VERSION Playwright"
           git push origin $BRANCH_NAME --force
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.PLAYWRIGHT_APP_ID }}
+          private-key: ${{ secrets.PLAYWRIGHT_PRIVATE_KEY }}
       - name: Check for existing Pull Request
         id: check-pr
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const { data: pullRequests } = await github.rest.pulls.list({
               owner: 'microsoft',
@@ -87,7 +92,7 @@ jobs:
         uses: actions/github-script@v7
         if: ${{ steps.prepare-branch.outputs.HAS_CHANGES == '1' && steps.check-pr.outputs.result == 'false' }}
         with:
-          github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             await github.rest.pulls.create({
               owner: 'microsoft',