ci(dependabot-changeset): use a deploy key instead of GITHUB_TOKEN [AR-59671] (drivenets#441)

Author: StyleShit

.github/workflows/dependabot-changeset.yml

@@ -1,6 +1,6 @@
 name: Dependabot Changeset
 
-on: pull_request_target # zizmor: ignore[dangerous-triggers] Need write base repo write access to commit the changeset. See warning below.
+on: pull_request
 
 permissions: {}
 
@@ -11,27 +11,19 @@ concurrency:
 jobs:
   generate:
     name: Generate
-
-    # IMPORTANT:
-    #   NEVER REMOVE THIS CONDITION!
-    #   We're using `pull_request_target` in order to have write access to the base repository
-    #   so we'll be able to commit the changeset file.
-    #   Removing the user check could give privileged access to a potential attacker.
     if: |
       github.event.pull_request.user.login == 'dependabot[bot]' &&
       startsWith(github.head_ref, 'dependabot/npm_and_yarn/npm-production-')
 
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: write
-
     steps:
       - name: Checkout source code # zizmor: ignore[artipacked] Need persisted token to commit the changeset.
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           ref: ${{ github.head_ref }}
+          ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: Install Dependencies
         uses: ./.github/actions/install