Merging upstream version 1.10.4+dfsg.

Signed-off-by: Daniel Baumann <daniel@debian.org>

.github/workflows/codeql.yml

@@ -31,6 +31,7 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
         with:
+          config-file: ./.github/codeql/codeql-config.yml
           languages: "javascript"
           queries: +security-and-quality
 

.github/workflows/deploy.yml

@@ -46,6 +46,8 @@ jobs:
   publish:
     needs: deploy
     runs-on: ubuntu-latest
+    if: github.repository == 'twbs/icons'
+
     steps:
       - name: Clone repository
         uses: actions/checkout@v3

.github/workflows/release-notes.yml

@@ -6,9 +6,17 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   update_release_draft:
+    permissions:
+      # allow release-drafter/release-drafter to create GitHub releases and add labels to PRs
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
+    if: github.repository == 'twbs/icons'
     steps:
       - uses: release-drafter/release-drafter@v5
         env:

.github/workflows/test.yml

@@ -2,8 +2,9 @@ name: Tests
 
 on:
   push:
-    branches-ignore:
-      - "dependabot/**"
+    branches:
+      - main
+      - "!dependabot/**"
   pull_request:
   workflow_dispatch:
 
@@ -11,6 +12,9 @@ env:
   FORCE_COLOR: 2
   NODE: 18
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest