Chore: i18n action - get secrets stuff from vault (#104816)

get PR_AUTOMATION stuff from vault

.github/workflows/i18n-crowdin-download.yml

@@ -15,12 +15,23 @@ jobs:
       id-token: write # needed to get vault secrets
 
     steps:
+      - name: "Get vault secrets"
+        id: vault-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
+        with:
+          # Vault secret paths:
+          # - ci/repo/grafana/grafana/grafana_frontend_platform_crowdin_bot
+          repo_secrets: |
+            CROWDIN_TOKEN=grafana_frontend_platform_crowdin_bot:access_token
+            GRAFANA_PR_AUTOMATION_APP_ID=grafana_pr_automation_app:app_id
+            GRAFANA_PR_AUTOMATION_APP_PEM=grafana_pr_automation_app:app_pem
+
       - name: Generate token
         id: generate_token
         uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92
         with:
-          app_id: ${{ secrets.GRAFANA_PR_AUTOMATION_APP_ID }}
-          private_key: ${{ secrets.GRAFANA_PR_AUTOMATION_APP_PEM }}
+          app_id: ${{ env.GRAFANA_PR_AUTOMATION_APP_ID }}
+          private_key: ${{ env.GRAFANA_PR_AUTOMATION_APP_PEM }}
 
       - uses: actions/checkout@v4
         with:
@@ -28,15 +39,6 @@ jobs:
           token: ${{ steps.generate_token.outputs.token }}
           persist-credentials: false
 
-      - name: "Get vault secrets"
-        id: vault-secrets
-        uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
-        with:
-          # Vault secret paths:
-          # - ci/repo/grafana/grafana/grafana_frontend_platform_crowdin_bot
-          repo_secrets: |
-            CROWDIN_TOKEN=grafana_frontend_platform_crowdin_bot:access_token
-
       - name: Download sources
         id: crowdin-download
         uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2