Set up an auto-update workflow for gha.sum on Pull Requests from Dependabot

.github/workflows/gha.sum

@@ -4,3 +4,5 @@ actions/[email protected] 5uAXl352I8XStCYyGTbGN7KcAaq2TyH8pPYNxivPuJo=
 actions/[email protected] lSvPPozeojJimtMLZ7cX1J/h8r1i30yGoTYQbst/jA4=
 github/[email protected] lzXmzNy+eVIfpHwZCI3wJmpy6U5VGiIPLmDCjet1oVs=
 ncipollo/[email protected] +JAIlT/RB99JgfxlDrAcAdBnaKX4y8hyFWnHc4j7tfM=
+stefanzweifel/[email protected] t2VeG9180CmZ5/cmxvkFkN6iWoWsOjlaJ2V8rp1HDqY=
+tibdex/[email protected] ZNSBo6XSE0yxs8IkHEkVtUC9MkEeXTclXpMLl6zAmCs=

.github/workflows/ghasum.yml

@@ -0,0 +1,38 @@
+name: ghasum
+on:
+  push:
+    branches:
+    - dependabot/github_actions/**
+
+permissions: read-all
+
+jobs:
+  update:
+    name: Update gha.sum
+    runs-on: ubuntu-22.04
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    permissions:
+      contents: write # To push a commit
+    steps:
+    - name: Create automation token
+      uses: tibdex/[email protected]
+      id: automation-token
+      with:
+        app_id: ${{ secrets.AUTOMATION_APP_ID }}
+        private_key: ${{ secrets.AUTOMATION_APP_KEY }}
+    - name: Checkout repository
+      uses: actions/[email protected]
+      with:
+        token: ${{ steps.automation-token.outputs.token }}
+    - name: Install Go
+      uses: actions/[email protected]
+      with:
+        go-version-file: go.mod
+    # NOTE: skip "Verify action checksums" because they might not be up-to-date
+    - name: Update gha.sum
+      run: go run ./cmd/ghasum update -force
+    - name: Commit gha.sum
+      uses: stefanzweifel/[email protected]
+      with:
+        commit_message: Update ghasum checksums
+        file_pattern: .github/workflows/gha.sum