ci: modernize update workflow (pypa#2010)

.github/workflows/update-dependencies.yml

@@ -20,6 +20,16 @@ jobs:
     if: github.repository_owner == 'pypa' || github.event_name != 'schedule'
     runs-on: ubuntu-latest
     steps:
+
+    # we use this step to grab a Github App auth token, so that PRs generated by this workflow
+    # run the GHA tests.
+    - uses: actions/create-github-app-token@v1
+      id: generate-token
+      if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
+      with:
+        app_id: ${{ secrets.CIBUILDWHEEL_BOT_APP_ID }}
+        private_key: ${{ secrets.CIBUILDWHEEL_BOT_APP_PRIVATE_KEY }}
+
     - uses: actions/checkout@v4
 
     - uses: wntrblm/nox@2024.04.15
@@ -33,15 +43,6 @@ jobs:
     - name: "Run update: docs user projects"
       run: nox --force-color -s update_proj -- --auth=${{ secrets.GITHUB_TOKEN }}
 
-    # we use this step to grab a Github App auth token, so that PRs generated by this workflow
-    # run the GHA tests.
-    - uses: tibdex/github-app-token@v2
-      id: generate-token
-      if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
-      with:
-        app_id: ${{ secrets.CIBUILDWHEEL_BOT_APP_ID }}
-        private_key: ${{ secrets.CIBUILDWHEEL_BOT_APP_PRIVATE_KEY }}
-
     - name: Create Pull Request
       if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
       uses: peter-evans/create-pull-request@v7
@@ -53,7 +54,6 @@ jobs:
 
           PR generated by "Update dependencies" [workflow](https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}).
         branch: update-dependencies-pr
-        committer: "cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>"
-        author: "cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>"
+        sign-commits: true
         token: ${{ steps.generate-token.outputs.token }}
         delete-branch: true