Update actions

Author: adamw

.github/labeler.yml

@@ -6,11 +6,11 @@ labels:
       - "build.sbt"
       - "project/Versions.scala"
       - "project/plugins.sbt"
-      - "examples/src/main/scala/.*"
+      - "examples\\/.*\\.scala"
   - label: "dependency"
     authors: ["softwaremill-ci"]
     files:
       - "build.sbt"
       - "project/Versions.scala"
       - "project/plugins.sbt"
-      - "examples/src/main/scala/.*"
+      - "examples\\/.*\\.scala"

.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
   push:
     branches: ['**']
     tags: [v*]
+permissions:
+  contents: write        # release-drafter, auto-merge requirement
+  pull-requests: write   # labeler, auto-merge requirement    
 env:
   # .sbtopts specifies 8g, which is needed to import into IntelliJ, but on GH that exceeds the maximum available memory
   SBT_JAVA_OPTS: -J-Xms4g -J-Xmx4g
@@ -34,7 +37,7 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v4
-    - uses: sbt/setup-sbt@v1
+    - uses: sbt/setup-sbt@3e125ece5c3e5248e18da9ed8d2cce3d335ec8dd # v1, specifically v1.1.14
     - name: Set up JDK 
       uses: actions/setup-java@v4
       with:
@@ -67,7 +70,7 @@ jobs:
         echo "STTP_NATIVE=1" >> $GITHUB_ENV
     - name: Install scala-cli
       if: matrix.target-platform == 'JVM' && matrix.java == '21' && matrix.scala-version == '3'
-      uses: VirtusLab/scala-cli-setup@main
+      uses: VirtusLab/scala-cli-setup@77834b5926f3eb70869d8009530c65585f7a039b # main, specifically v1.9.1
       with:
         jvm: '' # needed because scala-cli-setup otherwise forces the installation of their default JVM (17)
     - name: Enable Loom-specific modules
@@ -83,7 +86,7 @@ jobs:
       run: sbt $SBT_JAVA_OPTS -v "project examples3" verifyExamplesCompileUsingScalaCli
     - name: Test
       if: matrix.target-platform != 'JS'
-      uses: nick-fields/retry@v3
+      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3, specifically v3.0.2
       with:
         timeout_minutes: 8
         max_attempts: 4
@@ -121,7 +124,7 @@ jobs:
         name: 'tests-results-${{ matrix.scala-version }}-${{ matrix.target-platform }}-${{ matrix.java }}'
         path: '**/test-reports/TEST*.xml'
     - name: Prepare release notes
-      uses: release-drafter/release-drafter@v6
+      uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6, specifically v6.1.0
       with:
         config-name: release-drafter.yml
       env:
@@ -145,7 +148,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-      - uses: sbt/setup-sbt@v1
+      - uses: sbt/setup-sbt@3e125ece5c3e5248e18da9ed8d2cce3d335ec8dd # v1, specifically v1.1.14
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
@@ -181,7 +184,7 @@ jobs:
           COMMIT_MSG: ${{ github.event.head_commit.message }}
       - name: Publish release notes
         if: matrix.java == '11'
-        uses: release-drafter/release-drafter@v6
+        uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6, specifically v6.1.0
         with:
           config-name: release-drafter.yml
           publish: true

.github/workflows/dependency-graph.yml

@@ -6,11 +6,14 @@ on:
     branches:
       - master
 
+permissions:
+  contents: write # needed to submit the dependency graph
+
 jobs:
   update-graph:
     name: Update Dependency Graph
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
-      - uses: sbt/setup-sbt@v1
-      - uses: scalacenter/sbt-dependency-submission@v3
+      - uses: sbt/setup-sbt@3e125ece5c3e5248e18da9ed8d2cce3d335ec8dd # v1, specifically v1.1.14
+      - uses: scalacenter/sbt-dependency-submission@64084844d2b0a9b6c3765f33acde2fbe3f5ae7d3 # v3, specifically v3.1.0