switch to apache github actions & use GITHUB_TOKEN where possible

.github/dependabot.yml

@@ -1,5 +1,9 @@
 version: 2
 updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "weekly"
 - package-ecosystem: gradle
   directory: "/"
   schedule:

.github/workflows/gradle.yml

@@ -138,7 +138,7 @@ jobs:
         run: ./gradlew docs --refresh-dependencies
       - name: "🚀 Publish to Github Pages"
         if: steps.docs.outcome == 'success'
-        uses: grails/grails-github-actions/deploy-github-pages@main
+        uses: apache/grails-github-actions/deploy-github-pages@asf
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GRADLE_PUBLISH_RELEASE: 'false'
@@ -162,9 +162,20 @@ jobs:
         run: echo "value={\"message\":\"New Data Mapping Snapshots $(date) - $GITHUB_SHA\"}" >> $GITHUB_OUTPUT
       - name: "📡 Invoke the Java CI workflow in GORM Hibernate6"
         continue-on-error: true
-        uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1.2.4 (Use commit sha as this is a 3rd party action)
+        uses: actions/github-script@v6
         with:
-          workflow: Java CI
-          repo: grails/gorm-hibernate6
-          ref: ${{ steps.extract_branch.outputs.value }}
-          token: ${{ secrets.GH_TOKEN }}
+          debug: ${{ secrets.ACTIONS_RUNNER_DEBUG }}
+          github-token: ${{ secrets.GH_TOKEN }} # must be a PAT since we're triggering on an external repo
+          script: |
+            try {
+              const result = await github.rest.actions.createWorkflowDispatch({
+                owner: 'apache',
+                repo: 'grails-data-hibernate6',
+                workflow_id: 'gradle.yml',
+                ref: '${{ steps.extract_branch.outputs.value }}'
+              });
+              console.log(result);
+            } catch(error) {
+              console.error(error);
+              core.setFailed(error);
+            }

.github/workflows/release.yml

@@ -2,19 +2,16 @@ name: "Release"
 on:
   release:
     types: [published]
-env:
-  GIT_USER_NAME: grails-build
-  GIT_USER_EMAIL: [email protected]
+permissions:
+  contents: write
+  packages: read
 jobs:
   publish:
     name: "Publish to Sonatype Staging Repository"
     outputs:
       release_version: ${{ steps.release_version.outputs.value }}
       target_branch: ${{ steps.extract_branch.outputs.value }}
     runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-      packages: read
     steps:
       - name: "📥 Checkout repository"
         uses: actions/checkout@v4
@@ -28,7 +25,7 @@ jobs:
         with:
           develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
       - name: "⚙️ Run pre-release"
-        uses: grails/github-actions/pre-release@main
+        uses: apache/github-actions/pre-release@asf
       - name: "🔍 Determine Target Branch"
         id: extract_branch
         run: |
@@ -76,9 +73,6 @@ jobs:
     name: "Release Sonatype Staging Repository"
     needs: publish
     runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-      packages: read
     steps:
       - name: "📥 Checkout repository"
         uses: actions/checkout@v4
@@ -107,15 +101,12 @@ jobs:
           releaseSonatypeStagingRepository 
       - name: "⚙️ Run post-release"
         if: success()
-        uses: grails/github-actions/post-release@main
+        uses: apache/github-actions/post-release@asf
   docs:
     environment: release
     name: "Publish Documentation"
     needs: publish
     runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-      packages: read
     steps:
       - name: "📥 Checkout repository"
         uses: actions/checkout@v4
@@ -136,7 +127,7 @@ jobs:
         run: ./gradlew docs
       - name: "🚀 Publish to Github Pages"
         if: success()
-        uses: grails/grails-github-actions/deploy-github-pages@main
+        uses: apache/grails-github-actions/deploy-github-pages@asf
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GRADLE_PUBLISH_RELEASE: 'true'