fix: modernize GHA workflow and set appropriate permissions

Author: aduh95

.github/workflows/test.yml

@@ -2,18 +2,23 @@ name: Test
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: ubuntu-latest
 
     strategy:
       matrix:
-        node-version: [14.x, 15.x]
+        node-version: [lts/*, latest]
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v2.1.2
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
       - run: npm ci
@@ -23,23 +28,25 @@ jobs:
   # whenever changes are made that effects the `dist/index.js` bundle.
   release:
     needs: tests
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
+    if: github.ref == 'refs/heads/main' && github.repository == 'nodejs/node-pr-labeler'
 
     env:
       TAG: v1
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: true
       - name: Setup Node.js
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v7
         with:
-          node-version: 14.x
+          node-version: lts/*
 
-      - name: npm install and build
-        run: |
-          npm ci
-          npm run build
+      - run: npm ci
+      - run: npm run build
 
       - name: Check if dist/ has changed after build
         id: changedTest