Bump actions; upgrade milestone attacher

.github/workflows/milestone-merged-prs.yaml

@@ -1,18 +1,23 @@
 name: Milestone
 
 on:
-  pull_request_target:
-    types:
-      - closed
+  push:
     branches:
       - "main"
 
+permissions: {}
+
 jobs:
   milestone_pr:
-    name: attach to PR
+    if: github.repository == 'scientific-python/spin'
     runs-on: ubuntu-latest
+
+    permissions:
+      issues: write
+      pull-requests: write
+
     steps:
-      - uses: scientific-python/attach-next-milestone-action@c9cfab10ad0c67fed91b01103db26b7f16634639
+      - uses: scientific-python/attach-next-milestone-action@796cfa44ba1e1a9a4bce7896241d4612a3f06327
         with:
-          token: ${{ secrets.MILESTONE_LABELER_TOKEN }}
+          token: ${{ github.token }}
           force: true

.github/workflows/release.yml

@@ -14,11 +14,11 @@ jobs:
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         name: Install Python
         with:
           python-version: "3.11"

.github/workflows/test.yml

@@ -24,8 +24,8 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         id: setup-python
         with:
           python-version: ${{ matrix.python_version }}