ci: use bundled gh CLI instead of peter-evans/create-pull-request

Per @cclauss / zizmor 'superfluous actions' audit, persist the rolling
tracker PR with the gh CLI rather than a third-party action.

Author: priya-sundaram-dev

.github/workflows/hacktoberfest_prep.yml

@@ -61,27 +61,39 @@ jobs:
       # `master` is a protected branch: direct pushes are rejected with
       # `GH006: Protected branch update failed ... Changes must be made through
       # a pull request`. So instead of committing straight to master, persist
-      # the refreshed tracker by opening — or updating in place — a single
-      # rolling pull request. Re-runs reuse the same branch, so at most one
-      # open PR exists at any time.
+      # the refreshed tracker on a single rolling branch and open — or, since
+      # re-pushing the branch updates the existing PR in place, leave open — one
+      # pull request. Uses the bundled `gh` CLI rather than a third-party
+      # action (see zizmor's "superfluous actions" audit).
       - name: Open or update the tracker pull request
         if: github.event_name != 'push' && github.event_name != 'pull_request'
-        uses: peter-evans/create-pull-request@v7
-        with:
-          add-paths: docs/hacktober_2026_prep.md
-          branch: chore/hacktoberfest-2026-prep-refresh
-          delete-branch: true
-          commit-message: "chore: refresh Hacktoberfest 2026 prep tracker"
-          title: "chore: refresh Hacktoberfest 2026 prep tracker"
-          body: |
-            Automated daily refresh of the Hacktoberfest 2026 open-PR cleanup
-            tracker (`docs/hacktober_2026_prep.md`): ticks off any tracked pull
-            request that has since been merged/closed and rewrites the
-            **Automated statistics** section.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BRANCH: chore/hacktoberfest-2026-prep-refresh
+        run: |
+          set -euo pipefail
+          if git diff --quiet -- docs/hacktober_2026_prep.md; then
+            echo "No changes to docs/hacktober_2026_prep.md; nothing to persist."
+            exit 0
+          fi
+          git config --global user.name "$GITHUB_ACTOR"
+          git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"
+          git switch -c "$BRANCH"
+          git add docs/hacktober_2026_prep.md
+          git commit -m "chore: refresh Hacktoberfest 2026 prep tracker"
+          # Force-push so the rolling branch always carries just the latest
+          # snapshot on top of master; this also updates any open PR in place.
+          git push --force origin "$BRANCH"
+          if [ -z "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then
+            gh pr create \
+              --base master \
+              --head "$BRANCH" \
+              --title "chore: refresh Hacktoberfest 2026 prep tracker" \
+              --body "Automated daily refresh of the Hacktoberfest 2026 open-PR cleanup tracker (\`docs/hacktober_2026_prep.md\`): ticks off any tracked pull request that has since been merged/closed and rewrites the **Automated statistics** section.
 
-            This PR is updated in place by the `hacktoberfest_prep` workflow, so
-            it always reflects the latest scheduled run. Merge it whenever you
-            want to capture the current snapshot; a fresh one opens on the next
-            run if there are new changes.
+          This PR is updated in place by the \`hacktoberfest_prep\` workflow, so it always reflects the latest scheduled run. Merge it whenever you want to capture the current snapshot."
+          else
+            echo "Open tracker PR already exists; force-push updated it in place."
+          fi
       - name: Propagate the script's exit code
         run: exit ${{ steps.update.outputs.exit_code }}