[PATCH] Apply workflow_security_rollout patch

.github/workflows/CheckCompatBounds.yml

@@ -4,6 +4,6 @@ on:
 jobs:
   check-compat-bounds:
     name: "Check Compat Bounds"
-    uses: "ITensor/ITensorActions/.github/workflows/CheckCompatBounds.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/CheckCompatBounds.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

.github/workflows/CompatHelper.yml

@@ -9,7 +9,7 @@ permissions:
 jobs:
   compat-helper:
     name: "CompatHelper"
-    uses: "ITensor/ITensorActions/.github/workflows/CompatHelper.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/CompatHelper.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"
     secrets: "inherit"

.github/workflows/Deploy.yml

@@ -6,6 +6,8 @@ on:
   schedule:
     - cron: "0 0 * * *"
   workflow_dispatch: ~
+permissions:
+  contents: write
 jobs:
   aggregate:
     runs-on: "ubuntu-latest"

.github/workflows/FormatCheck.yml

@@ -1,16 +1,12 @@
 name: "Format Check"
 on:
-  pull_request_target:
+  pull_request:
     types:
       - "opened"
       - "synchronize"
       - "reopened"
       - "ready_for_review"
-permissions:
-  contents: "read"
-  actions: "write"
-  pull-requests: "write"
 jobs:
   format-check:
     name: "Format Check"
-    uses: "ITensor/ITensorActions/.github/workflows/FormatCheck.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/FormatCheck.yml@v1"

.github/workflows/FormatCheckComment.yml

@@ -0,0 +1,16 @@
+name: "Format Check Comment"
+on:
+  workflow_run:
+    workflows:
+      - "Format Check"
+    types:
+      - "completed"
+jobs:
+  comment:
+    name: "Format Check Comment"
+    if: "github.event.workflow_run.event == 'pull_request'"
+    permissions:
+      pull-requests: "write"
+      actions: "read"
+    uses: "ITensor/ITensorActions/.github/workflows/FormatCheckComment.yml@v1"
+    secrets: "inherit"

.github/workflows/FormatPullRequest.yml

@@ -12,5 +12,5 @@ permissions:
 jobs:
   format-pull-request:
     name: "Format Pull Request"
-    uses: "ITensor/ITensorActions/.github/workflows/FormatPullRequest.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/FormatPullRequest.yml@v1"
     secrets: "inherit"

.github/workflows/IntegrationTest.yml

@@ -3,7 +3,8 @@ on:
   push:
     branches:
       - "main"
-  pull_request_target:
+    tags: "*"
+  pull_request:
     types:
       - "opened"
       - "synchronize"
@@ -13,24 +14,9 @@ on:
 jobs:
   integration-test:
     name: "IntegrationTest"
-    strategy:
-      fail-fast: false
-      matrix:
-        pkg:
-          - "__none__"
-    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTest.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTest.yml@v1"
     secrets: "inherit"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"
-      pkg: "${{ matrix.pkg }}"
-  integration-gate:
-    name: "IntegrationTest"
-    needs: "integration-test"
-    if: "${{ always() && needs.integration-test.result != 'skipped' }}"
-    runs-on: "ubuntu-latest"
-    steps:
-      - name: "Fail if any downstream integration test failed"
-        run: |
-          echo "integration-test.result = ${{ needs.integration-test.result }}"
-          test "${{ needs.integration-test.result }}" = "success"
-
+      pkgs: |
+        []

.github/workflows/IntegrationTestRequest.yml

@@ -3,12 +3,17 @@ on:
   issue_comment:
     types:
       - "created"
+permissions:
+  actions: "read"
+  contents: "read"
+  checks: "write"
+  pull-requests: "write"
 jobs:
   integrationrequest:
     if: |
       github.event.issue.pull_request &&
       contains(fromJSON('["OWNER", "COLLABORATOR", "MEMBER"]'), github.event.comment.author_association)
-      
-    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTestRequest.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTestRequest.yml@v1"
+    secrets: "inherit"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

.github/workflows/Registrator.yml

@@ -16,7 +16,7 @@ permissions:
   issues: "write"
 jobs:
   Register:
-    uses: "ITensor/ITensorActions/.github/workflows/Registrator.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/Registrator.yml@v1"
     with:
       localregistry: "ITensor/ITensorRegistry"
     secrets: "inherit"

.github/workflows/TagBot.yml

@@ -9,5 +9,5 @@ env:
 jobs:
   TagBot:
     if: "github.event_name == 'workflow_dispatch' || github.actor == 'JuliaTagBot'"
-    uses: "ITensor/ITensorActions/.github/workflows/TagBot.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/TagBot.yml@v1"
     secrets: "inherit"

.github/workflows/Tests.yml

@@ -5,6 +5,7 @@ on:
       - "master"
       - "main"
       - "release-"
+    tags: "*"
     paths-ignore:
       - "docs/**"
   pull_request:
@@ -31,7 +32,7 @@ jobs:
           - "ubuntu-latest"
           - "macOS-latest"
           - "windows-latest"
-    uses: "ITensor/ITensorActions/.github/workflows/Tests.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/Tests.yml@v1"
     with:
       group: "${{ matrix.group }}"
       julia-version: "${{ matrix.version }}"

.github/workflows/VersionCheck.yml

@@ -4,6 +4,6 @@ on:
 jobs:
   version-check:
     name: "Version Check"
-    uses: "ITensor/ITensorActions/.github/workflows/VersionCheck.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/VersionCheck.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"