Merge branch '5.x'

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/builddoc.yml

@@ -2,6 +2,9 @@ name: Build document
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/coverage.yml

@@ -2,6 +2,9 @@ name: Coverage
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     runs-on: ubuntu-latest

.github/workflows/create-release.yml

@@ -5,8 +5,13 @@ on:
     tags:
     - "v*.*.*"
 
+permissions:
+  contents: read
+
 jobs:
   create-release:
+    permissions:
+      contents: write  # for softprops/action-gh-release to create GitHub release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/docutils-latest.yml

@@ -5,6 +5,9 @@ on:
   - cron: "0 0 * * SUN"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     if: github.repository_owner == 'sphinx-doc'

.github/workflows/lint.yml

@@ -2,6 +2,9 @@ name: Lint source code
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/lock.yml

@@ -13,8 +13,8 @@ jobs:
     if: github.repository_owner == 'sphinx-doc'
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v2
+      - uses: dessant/lock-threads@v3
         with:
           github-token: ${{ github.token }}
-          issue-lock-inactive-days: '30'
-          pr-lock-inactive-days: '30'
+          issue-inactive-days: '30'
+          pr-inactive-days: '30'

.github/workflows/main.yml

@@ -31,7 +31,7 @@ jobs:
       with:
         python-version: ${{ matrix.python }}
     - name: Set up Python ${{ matrix.python }} (deadsnakes)
-      uses: deadsnakes/action@v2.0.1
+      uses: deadsnakes/action@v2.1.1
       if: "endsWith(matrix.python, '-dev')"
       with:
         python-version: ${{ matrix.python }}

.github/workflows/transifex.yml

@@ -5,6 +5,9 @@ on:
   - cron: "0 0 * * SUN"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   push:
     if: github.repository_owner == 'sphinx-doc'
@@ -30,6 +33,9 @@ jobs:
         TX_TOKEN: ${{ secrets.TX_TOKEN }}
 
   pull:
+    permissions:
+      contents: write  # for peter-evans/create-pull-request to create branch
+      pull-requests: write  # for peter-evans/create-pull-request to create a PR
     if: github.repository_owner == 'sphinx-doc'
     runs-on: ubuntu-latest
 
@@ -54,7 +60,7 @@ jobs:
     - name: Compile message catalogs
       run:  python utils/babel_runner.py compile
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v3
+      uses: peter-evans/create-pull-request@v4
       with:
         commit-message: 'Update message catalogs'
         branch: bot/pull-translations