Trunk: Annotate PRs and Auto-Upgrade (#6091)

.github/workflows/nightly.yml

@@ -4,9 +4,11 @@ on:
     - cron: 0 8 * * 1-5
   workflow_dispatch: {}
 
+permissions: read-all
+
 jobs:
   trunk_check:
-    name: Trunk Check Upload
+    name: Trunk Check and Upload
     runs-on: ubuntu-latest
 
     steps:
@@ -14,6 +16,20 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Trunk Check
-        uses: trunk-io/trunk-action@782e83f803ca6e369f035d64c6ba2768174ba61b
+        uses: trunk-io/trunk-action@v1
         with:
           trunk-token: ${{ secrets.TRUNK_TOKEN }}
+
+  trunk_upgrade:
+    name: Trunk Upgrade (PR)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # For trunk to create PRs
+      pull-requests: write # For trunk to create PRs
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # See https://github.com/trunk-io/trunk-action/blob/v1/readme.md#automatic-upgrades
+      - name: Trunk Upgrade
+        uses: trunk-io/trunk-action/upgrade@v1