Update actions

Author: adamw

.github/labeler.yml

@@ -1,14 +1,14 @@
 version: 1
 labels:
   - label: "automerge"
-    authors: ["softwaremill-ci"]
+    authors: ["github-actions[bot]"]
     files:
       - "build.sbt"
       - "project/build.properties"
       - "project/Versions.scala"
       - "project/plugins.sbt"
   - label: "dependency"
-    authors: ["softwaremill-ci"]
+    authors: ["github-actions[bot]"]
     files:
       - "build.sbt"
       - "project/build.properties"

.github/release-drafter.yml

@@ -1,4 +1,4 @@
 template: |
-  ## What’s Changed
+  ## What's Changed
 
   $CHANGES

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
   push:
     branches: [ master ]
     tags: [ v* ]
+permissions:
+  contents: write        # release-drafter, auto-merge requirement
+  pull-requests: write   # labeler, auto-merge requirement    
 jobs:
   ci:
     runs-on: ubuntu-24.04
@@ -21,7 +24,7 @@ jobs:
         distribution: 'temurin'
         java-version: ${{ matrix.java }}
         cache: 'sbt'
-    - uses: sbt/setup-sbt@v1
+    - uses: sbt/setup-sbt@3e125ece5c3e5248e18da9ed8d2cce3d335ec8dd # v1, specifically v1.1.14
     - name: Check formatting
       run: sbt -v scalafmtCheckAll
     - name: Compile
@@ -52,12 +55,14 @@ jobs:
       java-version: '21'
 
   label:
-    # only for PRs by softwaremill-ci
-    if: github.event.pull_request.user.login == 'softwaremill-ci'
+    # only for PRs by github-actions[bot]
+    if: github.event.pull_request.user.login == 'github-actions[bot]'
     uses: softwaremill/github-actions-workflows/.github/workflows/label.yml@main
+    secrets: inherit
 
   auto-merge:
-    # only for PRs by softwaremill-ci
-    if: github.event.pull_request.user.login == 'softwaremill-ci'
+    # only for PRs by github-actions[bot]
+    if: github.event.pull_request.user.login == 'github-actions[bot]'
     needs: [ ci, label, mima ]
-    uses: softwaremill/github-actions-workflows/.github/workflows/auto-merge.yml@main
+    uses: softwaremill/github-actions-workflows/.github/workflows/auto-merge.yml@main
+    secrets: inherit

.github/workflows/rebase-cmd-dispatch.yml

@@ -6,10 +6,14 @@ on:
     - cron: '0 0 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: write        # Required to checkout and push changes
+  pull-requests: write   # Required to create PRs for dependency updates
+
 jobs:
   scala-steward:
     uses: softwaremill/github-actions-workflows/.github/workflows/scala-steward.yml@main
     secrets:
-      repo-github-token: ${{secrets.REPO_GITHUB_TOKEN}}
+      github-token: ${{ secrets.GITHUB_TOKEN }}
     with:
-      java-version: '21'
+      java-version: '21'