From 7d9d67d84b31bfa406c3360f6c3673d5c2ec810d Mon Sep 17 00:00:00 2001
From: Conda Bot <18747875+conda-bot@users.noreply.github.com>
Date: Sun, 28 Jun 2026 03:54:40 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=A4=96=20updated=20file(s)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/cla.yml     | 12 ++++++++++++
 .github/workflows/issues.yml  | 11 +++++++++++
 .github/workflows/labels.yml  | 17 +++++++++++++++--
 .github/workflows/lock.yml    | 13 ++++++++++---
 .github/workflows/project.yml | 10 +++++++++-
 .github/workflows/stale.yml   | 13 ++++++++++---
 .github/workflows/update.yml  | 17 ++++++++++++-----
 7 files changed, 79 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 42d24ec3..ae14b8cd 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -6,8 +6,16 @@ on:
       - created
   pull_request_target:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   check:
+    name: Check CLA
     if: >-
       !github.event.repository.fork
       && (
@@ -16,6 +24,10 @@ jobs:
         || github.event_name == 'pull_request_target'
       )
     runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: write  # Required to update labels and comments on pull requests.
+      statuses: write  # Required to publish the CLA commit status.
     steps:
       - name: Check CLA
         uses: conda/actions/check-cla@7f6830b1428a9bd47f0b068892c77eae95207037 # v26.1.0
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index 573ef0f3..be1e1e79 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -6,6 +6,13 @@ on:
   issue_comment:
     types: [created]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 env:
   FEEDBACK_LBL: pending::feedback
   SUPPORT_LBL: pending::support
@@ -15,12 +22,16 @@ jobs:
   # TODO: create conda-issue-sorting team and modify this to toggle label based on
   # whether a non-issue-sorting engineer commented
   pending_support:
+    name: Update pending support label
     # if [pending::feedback] and anyone responds
     if: >-
       !github.event.repository.fork
       && !github.event.issue.pull_request
       && contains(github.event.issue.labels.*.name, 'pending::feedback')
     runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      issues: write  # Required to remove and add issue triage labels.
     steps:
       # remove [pending::feedback]
       - uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 7ba0ec7d..02a9c1e4 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -15,18 +15,31 @@ on:
         default: false
         type: boolean
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   sync:
+    name: Sync labels
     if: '!github.event.repository.fork'
     runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      issues: write  # Required to create, update, and delete repository issue labels.
     env:
       GLOBAL: https://raw.githubusercontent.com/conda/infra/main/.github/global.yml
       LOCAL: .github/labels.yml
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - id: has_local
-        uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3.0.0
+        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3.1.0
         with:
           files: ${{ env.LOCAL }}
 
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 7e73297b..725ba3e4 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -8,16 +8,23 @@ on:
   schedule:
     - cron: 0 6 * * *
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}
+  cancel-in-progress: true
+
 permissions:
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   lock:
+    name: Lock inactive threads
     if: '!github.event.repository.fork'
     runs-on: ubuntu-slim
+    permissions:
+      issues: write  # Required to lock inactive issues.
+      pull-requests: write  # Required to lock inactive pull requests.
     steps:
-      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
+      - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
           # Number of days of inactivity before a closed issue is locked
           issue-inactive-days: 180
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 9ff94eb8..31b1d242 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -5,12 +5,20 @@ on:
     types:
       - opened
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   add_to_project:
+    name: Add pull request to project
     if: '!github.event.repository.fork'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
         with:
           # PRs are added to the Review project
           project-url: https://github.com/orgs/conda/projects/16
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 00e91181..2c43c061 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -14,14 +14,21 @@ on:
   schedule:
     - cron: 0 4 * * *
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}
+  cancel-in-progress: true
+
 permissions:
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   stale:
+    name: Mark stale threads
     if: '!github.event.repository.fork'
     runs-on: ubuntu-slim
+    permissions:
+      issues: write  # Required to mark and close stale issues.
+      pull-requests: write  # Required to mark and close stale pull requests.
     strategy:
       matrix:
         include:
@@ -38,7 +45,7 @@ jobs:
         with:
           path: https://raw.githubusercontent.com/conda/infra/main/.github/messages.yml
 
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         id: stale
         with:
           # Only issues with these labels are checked whether they are stale
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 3ec9a1a0..ffb6030b 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -8,18 +8,23 @@ on:
 
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   update:
+    name: Update repository files
     runs-on: ubuntu-slim
     permissions:
-      contents: write
-      pull-requests: write
-      issues: write
+      contents: write  # Required to commit synced template and workflow updates.
+      pull-requests: write  # Required to open the generated update pull request.
+      issues: write  # Required for generated update pull request metadata.
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ env.REPOSITORY || github.repository }}
           ref: ${{ env.REF || '' }}
@@ -47,7 +52,9 @@ jobs:
 
       - name: Create fork
         # no-op if the repository is already forked
-        run: echo FORK=$(gh repo fork --clone=false --default-branch-only 2>&1 | awk '{print $1}') >> $GITHUB_ENV
+        run: |
+          FORK="$(gh repo fork --clone=false --default-branch-only 2>&1 | awk '{print $1}' | sed 's|^https://github.com/||')"
+          echo "FORK=${FORK}" >> "$GITHUB_ENV"
         env:
           GH_TOKEN: ${{ secrets.SYNC_TOKEN }}