Sync .github\workflows\update-sdks.yml

Author: SyncFileContents

.github/workflows/update-sdks.yml

@@ -15,8 +15,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# Default permissions
-permissions: read-all
+# Default permissions. Read-only at the workflow level, with the single job that needs to write
+# requesting exactly what it needs below.
+permissions:
+  contents: read
 
 env:
   DOTNET_VERSION: "10.0"
@@ -32,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -41,11 +43,17 @@ jobs:
           persist-credentials: true
 
       - name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}.x
+          # Keyed on the files that actually pin versions. See the same note in dotnet.yml. This
+          # workflow rewrites the SDK versions in global.json, so including it here also means the
+          # verification build after an update does not restore against a stale key.
           cache: true
-          cache-dependency-path: "**/*.csproj"
+          cache-dependency-path: |
+            **/*.csproj
+            **/Directory.Packages.props
+            **/global.json
 
       - name: Configure Git
         run: |