CI: Post-release process branch / PR migration (#100930)

* update output for token in release-comms

* use token from needs

* generate token in individual workflows

* Set secrets

* define secrest in referenced workflows

* wrong secret lol

* oops

* grafana/grafana -> grafana/grafana-enterprise

.github/workflows/migrate-prs.yml

@@ -16,7 +16,9 @@ on:
         required: true
         type: string
     secrets:
-      token:
+      GRAFANA_DELIVERY_BOT_APP_ID:
+        required: true
+      GRAFANA_DELIVERY_BOT_APP_PEM:
         required: true
   workflow_dispatch:
     inputs:
@@ -33,17 +35,25 @@ on:
         required: true
         type: string
     secrets:
-      token:
+      GRAFANA_DELIVERY_BOT_APP_ID:
+        required: true
+      GRAFANA_DELIVERY_BOT_APP_PEM:
         required: true
 
 jobs:
   main:
     runs-on: ubuntu-latest
     steps:
+      - name: "Generate token"
+        id: generate_token
+        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92
+        with:
+          app_id: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_ID }}
+          private_key: ${{ secrets.GRAFANA_DELIVERY_BOT_APP_PEM }}
       - name: Migrate PRs
         uses: grafana/grafana-github-actions-go/migrate-open-prs@main
         with:
-          token: ${{ secrets.token }}
+          token: ${{ steps.generate_token.outputs.token }}
           ownerRepo: ${{ inputs.ownerRepo }}
           from: ${{ inputs.from }}
           to: ${{ inputs.to }}