Update actions

Author: adamw

.github/labeler.yml

@@ -1,13 +1,13 @@
 version: 1
 labels:
   - label: "automerge"
-    authors: ["softwaremill-ci"]
+    authors: ["github-actions[bot]"]
     files:
       - "build.sbt"
       - "project/plugins.sbt"
       - "project/build.properties"
   - label: "dependency"
-    authors: ["softwaremill-ci"]
+    authors: ["github-actions[bot]"]
     files:
       - "build.sbt"
       - "project/plugins.sbt"

.github/release-drafter.yaml

@@ -1,4 +1,4 @@
 template: |
-  ## What’s Changed
+  ## What's Changed
 
   $CHANGES

.github/workflows/bootzooka-ci.yml

@@ -12,6 +12,10 @@ on:
     types:
       - released
 
+permissions:
+  contents: write        # release-drafter, auto-merge requirement
+  pull-requests: write   # labeler, auto-merge requirement
+
 jobs:
   verify:
     runs-on: ubuntu-24.04
@@ -28,7 +32,7 @@ jobs:
           java-version: "21"
           cache: "sbt"
 
-      - uses: sbt/setup-sbt@v1
+      - uses: sbt/setup-sbt@3e125ece5c3e5248e18da9ed8d2cce3d335ec8dd # v1, specifically v1.1.14
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
@@ -64,7 +68,7 @@ jobs:
           java-version: "21"
           cache: "sbt"
 
-      - uses: sbt/setup-sbt@v1
+      - uses: sbt/setup-sbt@3e125ece5c3e5248e18da9ed8d2cce3d335ec8dd # v1, specifically v1.1.14
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
@@ -76,7 +80,7 @@ jobs:
         run: sbt "backend/generateOpenAPIDescription"
 
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3, specifically v3.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -85,12 +89,12 @@ jobs:
         run: sbt 'set docker / version := "'${GITHUB_RUN_ID}-${GITHUB_SHA:0:7}'"' docker/docker:publish
 
   label:
-    # only for PRs by softwaremill-ci
-    if: github.event.pull_request.user.login == 'softwaremill-ci'
+    # only for PRs by github-actions[bot]
+    if: github.event.pull_request.user.login == 'github-actions[bot]'
     uses: softwaremill/github-actions-workflows/.github/workflows/label.yml@main
 
   auto-merge:
-    # only for PRs by softwaremill-ci
-    if: github.event.pull_request.user.login == 'softwaremill-ci'
+    # only for PRs by github-actions[bot]
+    if: github.event.pull_request.user.login == 'github-actions[bot]'
     needs: [verify, label]
     uses: softwaremill/github-actions-workflows/.github/workflows/auto-merge.yml@main

.github/workflows/bootzooka-helm-ci.yaml

@@ -12,6 +12,10 @@ on:
       - "helm/**"
       - ".github/**"
 
+permissions:
+  contents: write        # release-drafter, auto-merge requirement
+  pull-requests: write   # labeler, auto-merge requirement
+
 jobs:
   lint-chart:
     name: Lint Helm Chart
@@ -24,7 +28,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4.3.0
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4, specifically v4.3.1
         with:
           version: v3.17.1
 
@@ -34,7 +38,7 @@ jobs:
           check-latest: true
 
       - name: Set up chart-testing
-        uses: helm/[email protected]
+        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2, specifically v2.7.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -68,13 +72,13 @@ jobs:
 
       - name: Create kind ${{ matrix.k8s }} cluster
         id: kind-cluster-setup
-        uses: helm/[email protected]
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1, specifically v1.12.0
         with:
           node_image: kindest/node:${{ matrix.k8s }}
           wait: "120s"
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4.3.0
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4, specifically v4.3.1
         with:
           version: v3.17.1
 
@@ -84,7 +88,7 @@ jobs:
           check-latest: true
 
       - name: Set up chart-testing
-        uses: helm/[email protected]
+        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2, specifically v2.7.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -113,7 +117,7 @@ jobs:
 
       - name: Run helm-docs
         id: helm-docs-run
-        uses: softwaremill/helm-docs-action@main
+        uses: softwaremill/helm-docs-action@874f27f2798f274bad83f9fa8205bfa5715de39e
 
       - name: Validate there's no diff
         id: git-no-diff

.github/workflows/dependabot-auto-merge.yml

@@ -18,7 +18,7 @@ jobs:
 
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.6.0
+        uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2, specifically v2.4.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/scala-steward.yml

@@ -6,8 +6,14 @@ on:
     - cron: '0 0 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: write        # Required to checkout and push changes
+  pull-requests: write   # Required to create PRs for dependency updates
+
 jobs:
   scala-steward:
     uses: softwaremill/github-actions-workflows/.github/workflows/scala-steward.yml@main
     secrets:
-      repo-github-token: ${{secrets.REPO_GITHUB_TOKEN}}
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+    with:
+      java-version: '21'