ci: fix flake update (#8)

Co-authored-by: Floweynt <50057682+Floweynt@users.noreply.github.com>
Reviewed-on: #8

.github/workflows/diff-pr.yml

@@ -17,10 +17,18 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
+      - name: merge base branch
+        run: |
+          git config user.email "ci@localhost"
+          git config user.name "CI"
+          git fetch origin ${{ github.event.pull_request.base.ref }}
+          git merge --no-edit origin/${{ github.event.pull_request.base.ref }}
+
       - name: worktree base for diff
-        run: git worktree add "$RUNNER_TEMP/base" "${{ github.event.pull_request.base.sha }}"
+        run: git worktree add "$RUNNER_TEMP/base" "origin/${{ github.event.pull_request.base.ref }}"
 
       - name: build closures and render diff
         run: |

.github/workflows/flake-update.yml

@@ -5,21 +5,19 @@ on:
     - cron: "17 4 * * *"
   workflow_dispatch:
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   update:
     runs-on: nix
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - run: nix flake update -L
 
       - name: open/update PR
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.BOT_TOKEN }}
           API: ${{ github.api_url }}
           REPO: ${{ github.repository }}
         run: |