Merge pull request mas-cli#691 from rgoldberg/590-github

Configure GitHub workflows

.github/dependabot.yml

@@ -2,10 +2,24 @@
 ---
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: github-actions
     schedule:
-      interval: "daily"
+      interval: daily
+    directory: /
+    labels: [📚 dependencies]
     commit-message:
-      prefix: "⬆️"
-      include: "scope"
+      prefix: ⬆️
+      include: scope
+  - package-ecosystem: swift
+    schedule:
+      interval: daily
+    directory: /
+    ignore:
+      - dependency-name: nimble
+        update-types: major
+      - dependency-name: quick
+        update-types: major
+    labels: [📚 dependencies]
+    commit-message:
+      prefix: ⬆️
+      include: scope

.github/release.yml

@@ -2,12 +2,9 @@
 ---
 changelog:
   categories:
-    - title: "🚀 Features"
-      labels:
-        - "🆕 feature request"
-    - title: "🐛 Bug Fixes"
-      labels:
-        - "🐛 bug"
+    - title: 🚀 Features
+      labels: [🆕 feature request]
+    - title: 🐛 Bug Fixes
+      labels: [🐛 bug]
     - title: Changes
-      labels:
-        - "*"
+      labels: ["*"]

.github/workflows/build-test.yml

@@ -11,6 +11,7 @@ on:
 concurrency:
   group: ${{github.workflow}}-${{github.ref}}
   cancel-in-progress: true
+permissions: {}
 jobs:
   build-test:
     name: Build, Test, and Lint
@@ -20,7 +21,12 @@ jobs:
         # Force all run commands to not use Rosetta 2
         shell: arch -arm64 /bin/zsh -Negku {0}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          GIT_CONFIG_COUNT: 1
+          GIT_CONFIG_KEY_0: init.defaultBranch
+          GIT_CONFIG_VALUE_0: ${{github.event.repository.default_branch}}
+        uses: actions/checkout@v4
         with:
           # Include all history & tags for script/version
           fetch-depth: 0

.github/workflows/release-published.yml

@@ -6,6 +6,10 @@ name: release-published
 on:
   release:
     types: [published]
+permissions:
+  actions: read
+  contents: write
+  pull-requests: write
 defaults:
   run:
     # Force all run commands to not use Rosetta 2

.github/workflows/tag-pushed.yml

@@ -6,6 +6,8 @@ name: tag-pushed
 on:
   push:
     tags: ["**"]
+permissions:
+  contents: write
 defaults:
   run:
     # Force all run commands to not use Rosetta 2