Update dependencies

.github/workflows/bot.yml

@@ -4,6 +4,10 @@ on:
 
 name: Bot
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   pr_pre_comment:
     # This job only runs for pull request comments
@@ -18,17 +22,23 @@ jobs:
             issue_number: context.issue.number,
             owner: context.repo.owner,
             repo: context.repo.repo,
-            body: "Start taking snapshots for this pull request.\n" +
+            body: "Start taking snapshots for this pull request. Please note that this process requires manual approval from a maintainer so that you may need to wait hours. Please be patient.\n" +
                   `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`
           });
+  pr_snapshot_approval:
+    name: Wait approval for bot execution
+    needs: [pr_pre_comment]
+    if: ${{ github.event.issue.pull_request && github.event.comment.body == '/snapshot' }}
+    runs-on: ubuntu-latest
+    environment: bot
+    steps:
+    - run: echo "Approved by a maintainer"
   pr_snapshot:
     # This job only runs for pull request comments
     name: Generate a snapshot
-    needs: [pr_pre_comment]
+    needs: [pr_snapshot_approval]
     if: ${{ github.event.issue.pull_request && github.event.comment.body == '/snapshot' }}
     strategy:
-      # Do not run in parallel because we may create a new commit
-      max-parallel: 1
       matrix:
         name: [windows, linux]
         include:
@@ -37,6 +47,10 @@ jobs:
         - name: linux
           os: ubuntu-latest
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     env:
       # Set TRYCMD=overwrite to update snapshot
       TRYCMD: overwrite
@@ -76,7 +90,7 @@ jobs:
           // Create a diff and comment it on the pull request.
           let stdOutput = '';
           let errOutput = '';
-          
+
           const options = {};
           options.listeners = {
             stdout: (data) => {
@@ -86,31 +100,31 @@ jobs:
               errOutput += data.toString();
             }
           };
-          
+
           const code = await exec.exec('git', ['diff', '--patch', '--indent-heuristic'], options);
-          
+
           // Output diff
           if (stdOutput !== '') {
             console.log("-- begin stdout --");
             console.log(stdOutput);
             console.log("-- end stdout --");
           }
-          
+
           // Output error
           if (errOutput !== '') {
             console.log("-- begin stderr --");
             console.log(errOutput);
             console.log("-- end stderr --");
           }
-          
+
           if (stdOutput !== '') {
             console.log("There are differences. Creating a comment...");
 
             const body = `You can apply a snapshot for ${{ matrix.name }} using \`git apply <diff-file>\`. The patch file is the following.
-          
+
           <details>
           <summary>git diff</summary>
-          
+
           \`\`\`diff
           ${stdOutput}
           \`\`\`