From 6ec0665e46714f15dab064f5b084f178793414fb Mon Sep 17 00:00:00 2001
From: Ryan Johnson <ryan.johnson@broadcom.com>
Date: Fri, 2 May 2025 16:58:04 -0400
Subject: [PATCH] chore(gh): update workflows

Update GitHub Actions.

Signed-off-by: Ryan Johnson <ryan.johnson@broadcom.com>
---
 .github/dependabot.yml                        | 15 +++++++++++
 .github/workflows/issues.yml                  |  9 +++++--
 .../workflows/{lock-threads.yml => lock.yml}  | 12 ++++++---
 .github/workflows/pull-requests.yml           |  9 ++++---
 .github/workflows/release.yml                 |  3 ++-
 .github/workflows/stale.yml                   | 26 ++++++++++---------
 6 files changed, 52 insertions(+), 22 deletions(-)
 create mode 100644 .github/dependabot.yml
 rename .github/workflows/{lock-threads.yml => lock.yml} (80%)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5c8636f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - chore
+      - github-actions
+    commit-message:
+      prefix: "chore(gh):"
+      include:
+        - dependency-name
+        - new-version
+      separator: " "
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index 16d6bcd..6c8122a 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -1,16 +1,21 @@
 ---
-name: Issue Triage
+name: Issue Labels
 
 on:
   issues:
     types:
     - opened
 
+permissions:
+  contents: read
+
 jobs:
   label-issues:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
-      - name: Apply Issue Triage Labels
+      - name: Apply Labels
         uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
         with:
           repo-token: '${{ secrets.GITHUB_TOKEN }}'
diff --git a/.github/workflows/lock-threads.yml b/.github/workflows/lock.yml
similarity index 80%
rename from .github/workflows/lock-threads.yml
rename to .github/workflows/lock.yml
index 93337dc..af45be1 100644
--- a/.github/workflows/lock-threads.yml
+++ b/.github/workflows/lock.yml
@@ -1,17 +1,23 @@
 ---
-name: Lock Threads
+name: Lock
 
 on:
   schedule:
     - cron: 30 00 * * *
 
+permissions:
+  contents: read
+
 jobs:
   lock:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
-      - uses: dessant/lock-threads@d42e5f49803f3c4e14ffee0378e31481265dda22 # v5.0.0
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:
-          github-token: '${{ secrets.GITHUB_TOKEN }}' 
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
           issue-comment: >
             I'm going to lock this issue because it has been closed for 30
             days. This helps our maintainers find and focus on the active
diff --git a/.github/workflows/pull-requests.yml b/.github/workflows/pull-requests.yml
index 73c044e..73cfa9e 100644
--- a/.github/workflows/pull-requests.yml
+++ b/.github/workflows/pull-requests.yml
@@ -4,7 +4,7 @@ name: Pull Request Labels
 on:
   pull_request_target:
     branches:
-      - develop
+      - main
     types:
       - opened
       - synchronize
@@ -12,12 +12,13 @@ on:
       - edited
       - ready_for_review
 
+permissions:
+  contents: read
+
 jobs:
-  labeler:
-    name: Labeler
+  label-pull-requests:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       pull-requests: write
     steps:
       - name: Apply Labels
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bc713f8..a5a771b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,3 +1,4 @@
+---
 name: Release
 
 on:
@@ -13,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
       - name: Check Changelog
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 787e5a0..4dce37a 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -1,10 +1,13 @@
 ---
-name: Manage Stale Items
+name: Stale
 
 on:
   schedule:
     - cron: 00 00 * * *
-      
+
+permissions:
+  contents: read
+
 jobs:
   stale:
     runs-on: ubuntu-latest
@@ -12,13 +15,13 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
-          days-before-stale: 60
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          days-before-stale: 360
           days-before-close: 30
-          exempt-issue-labels: 'needs-triage'
-          exempt-pr-labels: 'needs-review'
+          exempt-issue-labels: needs-triage
+          exempt-pr-labels: needs-review
           remove-stale-when-updated: true
           delete-branch: false
           stale-issue-label: stale
@@ -30,8 +33,8 @@ jobs:
 
             If this issue was automatically closed and you feel this issue
             should be reopened, we encourage creating a new issue linking back
-            to this one for added context. 
-            
+            to this one for added context.
+
             Thank you!'
           stale-pr-label: stale
           stale-pr-message: >
@@ -39,9 +42,8 @@ jobs:
             focus on the active pull requests. If this pull request receives no
             comments in the next 30 days it will automatically be closed.
 
-            
             If this pull request was automatically closed and you feel this pull
             request should be reopened, we encourage creating a new pull request
-            linking back to this one for added context. 
-            
+            linking back to this one for added context.
+
             Thank you!'