fix(ci): fix generate SDK workflow GPG signing and push auth

- Use setup-and-install action instead of manual checkout with
  persist-credentials: false
- Push via git push origin instead of manual URL construction
- Only run cleanup-git-signing when setup-git-signing actually ran
- Use checkout-ref for validate job

Author: jdalton

.github/workflows/generate.yml

@@ -45,11 +45,6 @@ jobs:
           echo "Sleeping for $delay seconds..."
           sleep $delay
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          token: ${{ secrets.GITHUB_TOKEN }}
-
       - uses: SocketDev/socket-registry/.github/actions/setup-and-install@da519693b701861bc0f9690a30f50af1a1dcd49c # main
 
       - name: Generate SDK
@@ -74,12 +69,11 @@ jobs:
         if: steps.check.outputs.has_changes == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
         run: |
           git checkout -b automated/open-api
           git add .
           git commit -m "fix(openapi): sync with openapi definition"
-          git push "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" automated/open-api -fu
+          git push origin automated/open-api -fu
 
       - name: Create Pull Request
         if: steps.check.outputs.has_changes == 'true'
@@ -94,7 +88,7 @@ jobs:
               --head automated/open-api \
               --base main \
               --title "Sync with OpenAPI definition" \
-              --body "## 🔄 OpenAPI Sync
+              --body "## OpenAPI Sync
 
           The OpenAPI definition in the API has been updated. This PR automatically:
           - Downloads the latest OpenAPI specification
@@ -105,15 +99,15 @@ jobs:
           ### What's Changed
           See the file changes below for specific updates to the API types, strict types, and methods.
 
-          ⚠️ **Please review carefully for any breaking changes in the API.**" \
+          **Please review carefully for any breaking changes in the API.**" \
               --label "dependencies" \
               --label "automated"
           else
             echo "PR #$existing_pr already exists, skipping creation"
           fi
 
       - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@da519693b701861bc0f9690a30f50af1a1dcd49c # main
-        if: always()
+        if: steps.check.outputs.has_changes == 'true' && always()
 
   validate:
     name: Validate generated SDK
@@ -125,12 +119,9 @@ jobs:
     outputs:
       has_changes: ${{ steps.check.outputs.has_changes }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          ref: automated/open-api
-
       - uses: SocketDev/socket-registry/.github/actions/setup-and-install@da519693b701861bc0f9690a30f50af1a1dcd49c # main
+        with:
+          checkout-ref: automated/open-api
 
       - name: Build SDK
         run: pnpm run build