Workflow tweaks

.github/workflows/npm-bump.yml

@@ -9,18 +9,23 @@ on:
         required: true
 
 env:
-  node_version: 16
+  node_version: lts/*
+  FORCE_COLOR: 2
+
+concurrency: # prevent concurrent releases
+  group: npm-bump
+  cancel-in-progress: true
 
 jobs:
   version_and_release:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2.4.0
+    - uses: actions/checkout@v2
       with:
         # fetch full history so things like auto-changelog work properly
         fetch-depth: 0
     - name: Use Node.js ${{ env.node_version }}
-      uses: actions/setup-node@v2.5.1
+      uses: actions/setup-node@v2
       with:
         node-version: ${{ env.node_version }}
         # setting a registry enables the NODE_AUTH_TOKEN env variable where we can set an npm token.  REQUIRED

.github/workflows/test.yml

@@ -2,19 +2,22 @@ name: tests
 
 on: [pull_request, push]
 
+env:
+  FORCE_COLOR: 2
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
 
     strategy:
       matrix:
         os: [ubuntu-latest]
-        node: [16]
+        node: [lts/*]
 
     steps:
-    - uses: actions/checkout@v2.4.0
+    - uses: actions/checkout@v2
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v2.5.1
+      uses: actions/setup-node@v2
       with:
         node-version: ${{ matrix.node-version }}
     - run: npm i
@@ -23,8 +26,11 @@ jobs:
   automerge:
     needs: test
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
     steps:
-      - uses: fastify/github-action-merge-dependabot@v2.7.1
+      - uses: fastify/github-action-merge-dependabot@v3.0.2
         if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request' && contains(github.head_ref, 'dependabot/github_actions') }}
         with:
           github-token: ${{secrets.github_token}}

.gitignore

@@ -4,3 +4,4 @@ coverage
 .vscode
 build
 package-lock.json
+sandbox.js