Speed up GHA workflows, use consistent bot token, etc (#55923)

.github/workflows/accept-baselines-fix-lints.yaml

@@ -16,11 +16,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: write
-
     steps:
       - uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
       - uses: actions/setup-node@v3
 
       - name: Configure Git, Run Tests, Update Baselines, Apply Fixes

.github/workflows/new-release-branch.yaml

@@ -17,13 +17,12 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: write
-
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
-          fetch-depth: 5
+          filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/
+          fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none.
+          token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
       - uses: actions/setup-node@v3
       - run: |
           npm --version
@@ -38,10 +37,11 @@ jobs:
           sed -i -e 's/const versionMajorMinor = ".*"/const versionMajorMinor = "${{ github.event.client_payload.core_major_minor }}"/g' tests/baselines/reference/api/tsserverlibrary.d.ts
           sed -i -e 's/const version\(: string\)\{0,1\} = `${versionMajorMinor}.0-.*`/const version = `${versionMajorMinor}.0-${{ github.event.client_payload.core_tag || 'dev' }}`/g' src/compiler/corePublic.ts
           npm ci
+          npm install # update package-lock.json to ensure the version bump is included
           npx hereby LKG
           npm test
           git diff
-          git add package.json
+          git add package.json package-lock.json
           git add src/compiler/corePublic.ts
           git add tests/baselines/reference/api/typescript.d.ts
           git add tests/baselines/reference/api/tsserverlibrary.d.ts

.github/workflows/rich-navigation.yml

@@ -24,9 +24,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 5
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v3
 

.github/workflows/set-version.yaml

@@ -16,14 +16,11 @@ defaults:
 jobs:
   build:
     runs-on: ubuntu-latest
-
-    permissions:
-      contents: write
-
     steps:
       - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.client_payload.branch_name }}
+          token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
       - uses: actions/setup-node@v3
       - run: |
           npm --version
@@ -44,10 +41,11 @@ jobs:
           sed -i -e 's/const versionMajorMinor = ".*"/const versionMajorMinor = "${{ github.event.client_payload.core_major_minor }}"/g' tests/baselines/reference/api/tsserverlibrary.d.ts
           sed -i -e 's/const version\(: string\)\{0,1\} = .*;/const version = "${{ github.event.client_payload.package_version }}" as string;/g' src/compiler/corePublic.ts
           npm ci
+          npm install # update package-lock.json to ensure the version bump is included
           npx hereby LKG
           npm test
           git diff
-          git add package.json
+          git add package.json package-lock.json
           git add src/compiler/corePublic.ts
           git add tests/baselines/reference/api/typescript.d.ts
           git add tests/baselines/reference/api/tsserverlibrary.d.ts

.github/workflows/sync-branch.yaml

@@ -22,16 +22,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: write
-
     steps:
       - uses: actions/setup-node@v3
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.branch_name || github.event.client_payload.branch_name }}
-          fetch-depth: 0
-      # This does a test post-merge and only pushes the result if the test succeeds
+          filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/
+          fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none.
+          token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
       # required client_payload members:
       # branch_name - the target branch
       - run: |
@@ -40,5 +38,7 @@ jobs:
           git fetch origin main
           git merge origin/main --no-ff
           npm ci
-          npm test
+          npx hereby LKG
+          git add --force ./lib
+          git commit -m 'Update LKG'
           git push

.github/workflows/twoslash-repros.yaml

@@ -34,9 +34,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - if: ${{ github.event.inputs.bisect }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/
+          fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none.
       - if: ${{ !github.event.inputs.bisect }}
         uses: actions/checkout@v3
       - uses: actions/setup-node@v3

.github/workflows/update-package-lock.yaml

@@ -21,9 +21,6 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'microsoft/TypeScript'
 
-    permissions:
-      contents: write
-
     steps:
       - uses: actions/checkout@v3
         with:
@@ -46,7 +43,7 @@ jobs:
             echo "No change."
           else
             npm test
-            npx hereby lkg
+            npx hereby LKG
             git config user.email "typescriptbot@microsoft.com"
             git config user.name "TypeScript Bot"
             git add -f package-lock.json