ci: move Lock Threads to dessant/lock-threads v6.0.2 (#24)

* ci: move Lock Threads to dessant/lock-threads v6.0.2

The pinned v4.0.0 rejects the job token: it validates github-token at
100 characters or fewer, and Actions tokens are now longer, so every
scheduled run fails with '"github-token" length must be less than or
equal to 100 characters long'.

v6.0.2 accepts them. The workflow now matches the one phishing already
runs: empty top-level permissions, issues/pull-requests write on the job
only, process-only issues and PRs (discussions write is no longer
granted), and a 10 minute timeout. Each repository keeps its schedule.

* ci: remove workflows that cannot run

push-master.yml listens on master, which no longer exists here (the
default branch is main), and needs GH_PAT_BOT and NPM_TOKEN, which are
not set. It has never run. Releases are published by hand to the next
tag first and verified against the registry before latest moves, so
this job is not the release path and would bypass that order if it were
revived.

.github/workflows/lock.yml

@@ -5,22 +5,22 @@ on:
   schedule:
     - cron: '10 1/3 * * *'
 
-
-# dessant/lock-threads locks closed issues, PRs and discussions.
-permissions:
-  issues: write
-  pull-requests: write
-  discussions: write
+permissions: {}
 
 jobs:
   lock:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      issues: write
+      pull-requests: write
     env:
       YARN_ENABLE_SCRIPTS: false
     steps:
-      - uses: dessant/lock-threads@c1b35aecc5cdb1a34539d14196df55838bb2f836
+      - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
           github-token: ${{ github.token }}
+          process-only: 'issues, prs'
           issue-inactive-days: '7'
           issue-comment: >
             This thread has been automatically locked since there has not been

.github/workflows/push-master.yml

@@ -1,36 +0,0 @@
-name: Master
-on:
-  push:
-    branches:
-      - master
-
-
-# Writes go through a separate bot token or app token; GITHUB_TOKEN stays read-only.
-permissions:
-  contents: read
-
-jobs:
-  master:
-    if: "! startsWith(github.event.head_commit.message, '[CI Skip]')"
-    strategy:
-      matrix:
-        step: ['build:release']
-    runs-on: ubuntu-latest
-    env:
-      YARN_ENABLE_SCRIPTS: false
-      CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
-      GH_PAT: ${{ secrets.GH_PAT_BOT }}
-      GH_RELEASE_GITHUB_API_TOKEN: ${{ secrets.GH_PAT_BOT }}
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-        token: ${{ secrets.GH_PAT_BOT }}
-    - uses: actions/setup-node@v4
-      with:
-        node-version: 'lts/*'
-    - name: ${{ matrix.step }}
-      run: |
-        yarn install --immutable
-        yarn ${{ matrix.step }}