update CI (#392)

* update CI

* allow create_tag to write

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: Push commit to schema registry
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -11,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Buf
-        uses: bufbuild/buf-setup-action@v1.18.0
+        uses: bufbuild/buf-setup-action@v1.26.1
         with:
           github_token: ${{ github.token }}
 

.github/workflows/create_tag.yml

@@ -1,5 +1,8 @@
 name: Create tag
 
+permissions:
+  contents: write
+
 on:
   workflow_dispatch:
     inputs:
@@ -18,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - id: version
@@ -47,7 +50,7 @@ jobs:
           echo "NEW_VERSION=v$MAJOR.$MINOR.$PATCH" >> $GITHUB_OUTPUT
 
       - name: Create release
-        uses: ncipollo/release-action@v1.12.0
+        uses: ncipollo/release-action@v1.13.0
         with:
           name: Meshtastic Protobufs ${{ steps.version.outputs.NEW_VERSION }}
           tag: ${{ steps.version.outputs.NEW_VERSION }}
@@ -55,7 +58,7 @@ jobs:
           token: ${{ github.token }}
 
       - name: Setup Buf
-        uses: bufbuild/buf-setup-action@v1
+        uses: bufbuild/buf-setup-action@v1.26.1
         with:
           github_token: ${{ github.token }}
 

.github/workflows/nightly.yml

@@ -1,19 +0,0 @@
-name: Nightly
-on:
-  schedule:
-    - cron: 0 8 * * 1-5
-  workflow_dispatch: {}
-
-jobs:
-  trunk_check:
-    name: Trunk Check Upload
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Trunk Check
-        uses: trunk-io/trunk-action@v1
-        with:
-          trunk-token: ${{ secrets.TRUNK_TOKEN }}

.github/workflows/publish.yml

@@ -1,5 +1,8 @@
 name: Push new version to schema registry
 
+permissions:
+  contents: read
+
 on:
   push:
     tags:
@@ -11,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Buf
-        uses: bufbuild/buf-setup-action@v1
+        uses: bufbuild/buf-setup-action@v1.26.1
         with:
           github_token: ${{ github.token }}
 

.github/workflows/pull_request.yml

@@ -1,4 +1,8 @@
 name: pull-request
+
+permissions:
+  contents: read
+
 on: pull_request
 jobs:
   build:
@@ -6,18 +10,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Buf
-        uses: bufbuild/buf-setup-action@v1
+        uses: bufbuild/buf-setup-action@v1.26.1
         with:
           github_token: ${{ github.token }}
 
       - name: Lint
-        uses: bufbuild/buf-lint-action@v1
+        uses: bufbuild/buf-lint-action@v1.0.3
 
       - name: Push to schema registry
-        uses: bufbuild/buf-push-action@v1
+        uses: bufbuild/buf-push-action@v1.1.1
         with:
           buf_token: ${{ secrets.BUF_TOKEN }}
           draft: ${{ github.ref_name != 'master'}}