chore(ci): workflow の権限を明示・Dependabot 導入

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  # workflow の action（SHA 固定）を更新する。SHA と末尾の # vX.Y.Z コメントを合わせて書き換えた PR が作られる
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "10:00"
+      timezone: "Asia/Tokyo"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"

.github/workflows/pr_check.yml

@@ -2,17 +2,25 @@ name: PR check
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   danger:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write  # Danger が PR にコメントするため
+      issues: read  # Danger が PR の情報(ラベル等)を issues API で読むため
+      statuses: write  # Danger が結果をコミットステータスに付けるため
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Java
         uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '17'
-      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.gradle/caches
@@ -42,7 +50,7 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: '17'
-      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.gradle/caches

.github/workflows/unit_test.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   unit_test:
     runs-on: ubuntu-latest
@@ -15,7 +18,7 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: '17'
-      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.gradle/caches