🤖 updated file(s)

.github/workflows/cla.yml

@@ -0,0 +1,35 @@
+name: CLA
+
+on:
+  issue_comment:
+    types:
+      - created
+  pull_request_target:
+
+jobs:
+  check:
+    if: >-
+      !github.event.repository.fork
+      && (
+        github.event.issue.pull_request
+        && github.event.comment.body == '@conda-bot check'
+        || github.event_name == 'pull_request_target'
+      )
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check CLA
+        uses: conda/actions/check-cla@15f883f14f4232f83658e3609c3316d58905138f # v24.8.0
+        with:
+          # [required]
+          # A token with ability to comment, label, and modify the commit status
+          # (`pull_request: write` and `statuses: write` for fine-grained PAT; `repo` for classic PAT)
+          # (default: secrets.GITHUB_TOKEN)
+          token: ${{ secrets.CLA_ACTION_TOKEN }}
+          # [required]
+          # Label to apply to contributor's PR once CLA is signed
+          label: cla-signed
+
+          # [required]
+          # Token for opening signee PR in the provided `cla_repo`
+          # (`pull_request: write` for fine-grained PAT; `repo` and `workflow` for classic PAT)
+          cla_token: ${{ secrets.CLA_FORK_TOKEN }}

.github/workflows/update.yml

@@ -44,7 +44,7 @@ jobs:
           echo REPOSITORY=$(curl --silent ${{ github.event.issue.pull_request.url }} | jq --raw-output '.head.repo.full_name') >> $GITHUB_ENV
           echo REF=$(curl --silent ${{ github.event.issue.pull_request.url }} | jq --raw-output '.head.ref') >> $GITHUB_ENV
 
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           repository: ${{ env.REPOSITORY || github.repository }}
           ref: ${{ env.REF || '' }}