Repo File Sync: Update to Mu DevOps v15.0.3 (#62)

synced local file(s) with
[microsoft/mu_devops](https://github.com/microsoft/mu_devops).

🤖: View the [Repo File Sync Configuration
File](https://github.com/microsoft/mu_devops/blob/main/.sync/Files.yml)
to see how files are synced.

---

This PR was created automatically by the
[repo-file-sync-action](https://github.com/BetaHuhn/repo-file-sync-action)
workflow run
[#16039182195](https://github.com/microsoft/mu_devops/actions/runs/16039182195)

Signed-off-by: Project Mu UEFI Bot <[email protected]>
Co-authored-by: mu-automation[bot] <204385837+mu-automation[bot]@users.noreply.github.com>

Author: mu-automation[bot]

.github/workflows/issue-assignment.yml

@@ -19,8 +19,5 @@ on:
 jobs:
   apply:
 
-    permissions:
-      contents: read
-      issues: write
-
-    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    secrets: inherit

.github/workflows/label-issues.yml

@@ -21,7 +21,7 @@ on:
     types:
       - edited
       - opened
-  pull_request:
+  pull_request_target:
     types:
       - edited
       - opened
@@ -31,9 +31,5 @@ on:
 
 jobs:
   apply:
-
-    permissions:
-      contents: read
-      pull-requests: write
-
-    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    secrets: inherit

.github/workflows/label-sync.yml

@@ -25,7 +25,5 @@ on:
 jobs:
   sync:
 
-    permissions:
-      issues: write
-
-    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    secrets: inherit

.github/workflows/pull-request-formatting-validator.yml

@@ -13,7 +13,7 @@
 name: Validate Pull Request Formatting
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - edited
       - opened
@@ -24,11 +24,15 @@ jobs:
   validate_pr:
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: read
-      pull-requests: write
-
     steps:
+      - name: Generate Token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.MU_ACCESS_APP_ID }}
+          private-key: ${{ secrets.MU_ACCESS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+
       - run: |
           prTitle="$(gh api graphql -F owner=$OWNER -F name=$REPO -F pr_number=$PR_NUMBER -f query='
             query($name: String!, $owner: String!, $pr_number: Int!) {
@@ -45,7 +49,7 @@ jobs:
           fi
 
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           OWNER: ${{ github.repository_owner }}
           PR_NUMBER: ${{ github.event.number }}
           PR_URL: ${{ github.event.pull_request.html_url }}

.github/workflows/release-draft.yml

@@ -29,9 +29,5 @@ jobs:
   draft:
     name: Draft Releases
 
-    permissions:
-      contents: write
-      pull-requests: write
-
-    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    uses: microsoft/mu_devops/.github/workflows/[email protected]
     secrets: inherit

.github/workflows/scheduled-maintenance.yml

@@ -25,17 +25,21 @@ jobs:
   repo_cleanup:
     runs-on: ubuntu-latest
 
-    permissions:
-      pull-requests: write
-      issues: write
-
     steps:
+      - name: Generate Token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.MU_ACCESS_APP_ID }}
+          private-key: ${{ secrets.MU_ACCESS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+
       - name: Get Repository Info
         run: echo "REPOSITORY_NAME=${GITHUB_REPOSITORY#*/}" >> $GITHUB_ENV
 
       - name: Prune Won't Fix Pull Requests
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           REPOSITORY: ${{ env.REPOSITORY_NAME }}
         run: |
           gh api \
@@ -50,7 +54,7 @@ jobs:
 
       - name: Prune Won't Fix Issues
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           REPOSITORY: ${{ env.REPOSITORY_NAME }}
         run: |
           gh api \

.github/workflows/stale.yml

@@ -25,8 +25,5 @@ on:
 jobs:
   check:
 
-    permissions:
-      issues: write
-      pull-requests: write
-
-    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    secrets: inherit

.github/workflows/triage-issues.yml

@@ -20,7 +20,5 @@ on:
 jobs:
   triage:
 
-    permissions:
-      issues: write
-
-    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    uses: microsoft/mu_devops/.github/workflows/[email protected]
+    secrets: inherit