Merge branch 'jreleaser' of github.com:awslabs/aws-sdk-kotlin into jreleaser

Author: 0marperez

.github/workflows/api-compat-verification.yml

@@ -7,6 +7,8 @@ on:
       - main
       - '*-main'
 
+permissions: { }
+
 jobs:
   api-compat-verification:
     runs-on: ubuntu-latest

.github/workflows/changelog-verification.yml

@@ -1,5 +1,8 @@
 name: Changelog verification
 
+permissions:
+  id-token: write
+
 on:
   pull_request:
     types: [ opened, synchronize, reopened, labeled, unlabeled ]
@@ -11,16 +14,11 @@ jobs:
   changelog-verification:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Check for changelog entry
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-changelog') }}
-        run: |
-          git fetch origin ${{ github.base_ref }} --depth 1 && \
-          git diff remotes/origin/${{ github.base_ref }} --name-only | grep -P "\.changes/[0-9a-f-]+\.json"
-      - name: Error message
-        if: ${{ failure() }}
-        run: |
-          echo "::error ::No new/updated changelog entry found in /.changes directory. Please either:"
-          echo "::error ::* Add a changelog entry (see CONTRIBUTING.md for instructions) –or–"
-          echo "::error ::* Add the 'no-changelog' label to this PR (in rare cases not warranting a changelog entry)"
-          exit 1
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
+          aws-region: us-west-2
+
+      - name: Verify changelog
+        uses: awslabs/aws-kotlin-repo-tools/.github/actions/changelog-verification@main

.github/workflows/closed-issue-message.yaml

@@ -1,7 +1,12 @@
 name: Closed Issue Message
+
 on:
     issues:
        types: [closed]
+
+permissions:
+  issues: write
+
 jobs:
     auto_comment:
         runs-on: ubuntu-latest

.github/workflows/continuous-integration.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions: { }
+
 # Allow one instance of this workflow per pull request, and cancel older runs when new changes are pushed
 concurrency:
   group: ci-pr-${{ github.ref }}

.github/workflows/issue-regression-labeler.yml

@@ -3,6 +3,7 @@ name: issue-regression-label
 on:
   issues:
     types: [opened, edited]
+permissions: { }
 jobs:
   add-regression-label:
     runs-on: ubuntu-latest

.github/workflows/lint.yml

@@ -12,6 +12,9 @@ on:
       - '*-main'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   PACKAGE_NAME: aws-sdk-kotlin
 

.github/workflows/merge-main.yml

@@ -4,6 +4,8 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+permissions: { }
+
 jobs:
   merge:
     runs-on: ubuntu-latest

.github/workflows/release-readiness.yml

@@ -8,6 +8,8 @@ on:
     types: [ opened, synchronize, reopened, labeled, unlabeled ]
     branches: [ main ]
 
+permissions: { }
+
 jobs:
   release-readiness:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'ready-for-release') }}

.github/workflows/stale_issue.yaml

@@ -5,6 +5,9 @@ on:
   schedule:
   - cron: "0 0/3 * * *"
 
+permissions:
+  issues: write
+
 jobs:
   cleanup:
     name: Stale issue job

.github/workflows/sync-mirror.yml

@@ -5,6 +5,8 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+permissions: { }
+
 jobs:
   git-sync:
     # Only sync when pushing to source repo