[INLONG-12083][CI] Upgrade github actions version and specify permission of actions (#12084)

Author: vernedeng

.github/labeler.yml

@@ -16,51 +16,66 @@
 #
 
 component/agent:
-  - 'inlong-agent/**/*'
+  - changed-files:
+    - any-glob-to-any-file: 'inlong-agent/**/*'
 
 component/dataproxy:
-  - 'inlong-dataproxy/**/*'
+  - changed-files:
+    - any-glob-to-any-file: 'inlong-dataproxy/**/*'
 
 component/manager:
-  - 'inlong-manager/**/*'
+  - changed-files:
+    - any-glob-to-any-file: 'inlong-manager/**/*'
 
 component/sort:
-  - 'inlong-sort/**/*'
-  - 'inlong-sort-standalone/**/*'
+  - changed-files:
+    - any-glob-to-any-file:
+      - 'inlong-sort/**/*'
+      - 'inlong-sort-standalone/**/*'
 
 component/tubemq:
-  - 'inlong-tubemq/**/*'
+  - changed-files:
+    - any-glob-to-any-file: 'inlong-tubemq/**/*'
 
 component/dashboard:
-  - 'inlong-dashboard/**/*'
+  - changed-files:
+    - any-glob-to-any-file: 'inlong-dashboard/**/*'
 
 component/audit:
-  - 'inlong-audit/**/*'
+  - changed-files:
+    - any-glob-to-any-file: 'inlong-audit/**/*'
 
 component/sdk:
-  - 'inlong-sdk/**/*'
+  - changed-files:
+    - any-glob-to-any-file: 'inlong-sdk/**/*'
 
 service/ci:
-  - '.github/actions/**/*'
-  - '.github/workflows/**/*'
-  - '.github/labeler.yml'
-  - '.github/PULL_REQUEST_TEMPLATE.md'
-  - '.github/ISSUE_TEMPLATE/**/*'
+  - changed-files:
+    - any-glob-to-any-file:
+      - '.github/actions/**/*'
+      - '.github/workflows/**/*'
+      - '.github/labeler.yml'
+      - '.github/PULL_REQUEST_TEMPLATE.md'
+      - '.github/ISSUE_TEMPLATE/**/*'
 
 service/docker:
-  - '**/Dockerfile'
-  - '**/*-docker.sh'
-  - 'inlong-agent/agent-docker/**/*'
-  - 'inlong-audit/audit-docker/**/*'
-  - 'inlong-dataproxy/dataproxy-docker/**/*'
-  - 'inlong-manager/manager-docker/**/*'
-  - 'inlong-tubemq/tubemq-docker/**/*'
-  - 'docker/docker-compose/**/*'
-  - 'docker/build-docker-images.sh'
-  - 'docker/publish-by-arch.sh'
+  - changed-files:
+    - any-glob-to-any-file:
+      - '**/Dockerfile'
+      - '**/*-docker.sh'
+      - 'inlong-agent/agent-docker/**/*'
+      - 'inlong-audit/audit-docker/**/*'
+      - 'inlong-dataproxy/dataproxy-docker/**/*'
+      - 'inlong-manager/manager-docker/**/*'
+      - 'inlong-tubemq/tubemq-docker/**/*'
+      - 'docker/docker-compose/**/*'
+      - 'docker/build-docker-images.sh'
+      - 'docker/publish-by-arch.sh'
 
 service/k8s:
-  - '.github/ct.yml'
-  - '.github/kind.yml'
-  - 'docker/kubernetes/**/*'
-  - 'inlong-tubemq/tubemq-docker/tubemq-k8s/**/*'
+  - changed-files:
+    - any-glob-to-any-file:
+      - '.github/ct.yml'
+      - '.github/kind.yml'
+      - 'docker/kubernetes/**/*'
+      - 'inlong-tubemq/tubemq-docker/tubemq-k8s/**/*'

.github/workflows/ci_build.yml

@@ -52,6 +52,9 @@ on:
       - 'inlong-tubemq/**'
       - '!**.md'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build

.github/workflows/ci_chart_test.yml

@@ -40,6 +40,9 @@ env:
   CT_CONFIG_PATH: '.github/ct.yml'
   KIND_CONFIG_PATH: '.github/kind.yml'
 
+permissions:
+  contents: read
+
 jobs:
   chart-test:
     name: Lint and test charts
@@ -57,12 +60,12 @@ jobs:
           submodules: true
 
       - name: Set up Helm
-        uses: azure/setup-helm@v1
+        uses: azure/setup-helm@v4
         with:
           version: v3.5.0
 
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: 3.7
 

.github/workflows/ci_check_format.yml

@@ -19,6 +19,9 @@ name: InLong Code Format Check
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Code Format Check

.github/workflows/ci_check_license.yml

@@ -19,6 +19,9 @@ name: InLong Check License Header
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   check-license:
     name: Check license header
@@ -28,7 +31,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Check license header
-        uses: apache/skywalking-eyes@v0.3.0
+        uses: apache/skywalking-eyes@v0.6.0
         with:
           log: info
           config: .licenserc.yaml

.github/workflows/ci_check_pr_title.yml

@@ -25,6 +25,9 @@ on:
       - edited
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Check pull request title

.github/workflows/ci_docker.yml

@@ -46,6 +46,9 @@ on:
       - 'inlong-tubemq/tubemq-docker/**'
       - '!**.md'
 
+permissions:
+  contents: read
+
 jobs:
   docker:
     name: Docker build and push
@@ -90,16 +93,16 @@ jobs:
           distribution: adopt
 
       - name: Set up Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@v5
         with:
           python-version: 3.7
 
       - name: Set up QEMU dependency
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Cache Maven packages
         uses: actions/cache@v4

.github/workflows/ci_greeting.yml

@@ -18,31 +18,29 @@
 name: InLong Greeting
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - opened
   issues:
     types:
       - opened
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   greeting:
-    name: Greeting
+    name: Greet First-Time Contributors
     runs-on: ubuntu-22.04
-    permissions:
-      issues: write
-      pull-requests: write
     steps:
-      - name: Interact with newcomers
-        uses: actions/first-interaction@v1
-        continue-on-error: true
+      - uses: actions/first-interaction@v3
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          pr-message: |
-            Hello @${{ github.actor }}, thank you for submitting a PR to InLong 💖 We will respond as soon as possible ⏳
-            This seems to be your first PR 🌠 Please be sure to follow our [Contribution Guidelines](https://inlong.apache.org/community/how-to-contribute).
-            If you have any questions in the meantime, you can also ask us on the [InLong Discussions](https://github.com/apache/inlong/discussions) 🔍
           issue-message: |
             Hello @${{ github.actor }}, thank you for opening your first issue in InLong 🧡 We will respond as soon as possible ⏳
             If this is a bug report, please provide screenshots or error logs for us to reproduce your issue, so we can do our best to fix it.
             If you have any questions in the meantime, you can also ask us on the [InLong Discussions](https://github.com/apache/inlong/discussions) 🔍
+          pr-message: |
+            Hello @${{ github.actor }}, thank you for submitting a PR to InLong 💖 We will respond as soon as possible ⏳
+            This seems to be your first PR 🌠 Please be sure to follow our [Contribution Guidelines](https://inlong.apache.org/community/how-to-contribute).
+            If you have any questions in the meantime, you can also ask us on the [InLong Discussions](https://github.com/apache/inlong/discussions) 🔍

.github/workflows/ci_labeler.yml

@@ -17,19 +17,25 @@
 
 name: InLong Pull Request Labeler
 
-on: pull_request
+on:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+
+permissions:
+  contents: read
+  pull-requests: write
 
 jobs:
   label:
     name: Label
     runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-      pull-requests: write
     steps:
       - name: Label the PR
-        uses: actions/labeler@v4
+        uses: actions/labeler@v5
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler.yml
-          sync-labels: true
+          sync-labels: true

.github/workflows/ci_stale.yml

@@ -30,7 +30,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Mark issues and PRs
-        uses: actions/stale@v5
+        uses: actions/stale@v9
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-issue-message: 'This issue is stale because it has been open for 60 days with no activity.'