From aec57f586914701dcae8946d0bd4b901d159f8ac Mon Sep 17 00:00:00 2001
From: Jeremy Bernard <jeremy.bernard@iex.ec>
Date: Mon, 26 Oct 2026 15:35:50 +0100
Subject: [PATCH] ci: update to latest Github Actions workflows

For release-please and conventional commit on PR titles,
configurations and permissions are updated up best practices.
---
 .github/workflows/ci.yaml                              | 4 ++--
 .github/workflows/conventional-commit-on-pr-title.yaml | 7 ++++---
 .github/workflows/release-please.yaml                  | 9 +++------
 3 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 22c184f3..28fb5964 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,8 +10,8 @@ on:
 jobs:
   build-and-test:
     name: Build, test and analyse
-    # java-build-v1.0.0
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/java-build.yml@230e504041b25d1e45dad1651ac29a9b9f827dd5
+    # java-build-v1.0.1
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/java-build.yml@0ef3bbf01085d84dc96167b099e137f11857e43e
     with:
       java-version: '21'
       sonar: true
diff --git a/.github/workflows/conventional-commit-on-pr-title.yaml b/.github/workflows/conventional-commit-on-pr-title.yaml
index 838b4e01..72abc1b8 100644
--- a/.github/workflows/conventional-commit-on-pr-title.yaml
+++ b/.github/workflows/conventional-commit-on-pr-title.yaml
@@ -1,11 +1,12 @@
 name: Conventional Commit as PR title
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
       - reopened
+      - synchronize
 
 jobs:
   lint-pr-title:
@@ -13,5 +14,5 @@ jobs:
     if: github.repository_owner == 'iExecBlockchainComputing'
     permissions:
       pull-requests: read
-    # conventional-commits-v1.2.1
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@7825b11bd6f0b141075368add5223c873d76a2d3
+    # conventional-commits-v1.2.3
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@36e876b00619725344c27c59748cc44d0d4d6e44
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index 17af62a1..99992045 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -5,17 +5,14 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   release-please:
     # Prevent execution on forks
     if: github.repository_owner == 'iExecBlockchainComputing'
-    # release-please-v2.2.1
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@1c4f92368b01037ca4f209c2f9179cf8a07f00ff
+    # release-please-v2.2.3
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@31ad5d9e686d47c7ebdd3c7df3f8c50f58415428
     secrets:
       RELEASE_PLEASE_APPLICATION_ID: ${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}
       RELEASE_PLEASE_PRIVATE_KEY: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}