ci(cmd): fix reaction permissions and drop deprecated regex action (#205)

* ci(cmd): fix reaction permissions and drop deprecated regex action

The acknowledge job failed with "Resource not accessible by integration"
when reacting to a comment on a PR: reacting to a PR conversation comment
needs pull-requests: write, but the job only granted issues: write. Add
pull-requests: write to acknowledge, and to clean/help which share the
same comment/reaction pattern.

Replace actions-ecosystem/action-regex-match (Node 20 + deprecated
set-output) in get-pr-info with an inline actions/github-script step,
preserving the group2 output.

* Update from github-actions[bot] running command 'fmt'

---------

Co-authored-by: cmd[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: bkontur

.github/workflows/cmd.yml

@@ -62,6 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       issues: write
+      pull-requests: write
     steps:
       - name: Add reaction to triggered comment
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -79,6 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       issues: write
+      pull-requests: write
     steps:
       - name: Clean previous comments
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -127,11 +129,15 @@ jobs:
       repo: ${{ steps.get-pr.outputs.repo }}
     steps:
       - name: Get command
-        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2.0.2
         id: get-comment
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
         with:
-          text: ${{ github.event.comment.body }}
-          regex: "^(\\/cmd )([-\\/\\s\\w.=:]+)$" # see explanation in docs/contributor/commands-readme.md#examples
+          script: |
+            // see explanation in docs/contributor/commands-readme.md#examples
+            const match = process.env.COMMENT_BODY.match(/^(\/cmd )([-\/\s\w.=:]+)$/);
+            core.setOutput('group2', match ? match[2] : '');
 
       # Get PR branch name, because the issue_comment event does not contain the PR branch name
       - name: Check if the issue is a PR
@@ -180,6 +186,7 @@ jobs:
     permissions:
       contents: read
       issues: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

deny.toml

@@ -5,25 +5,25 @@
 [licenses]
 version = 2
 allow = [
-    "Apache-2.0",
-    "Apache-2.0 WITH LLVM-exception",
-    "BSD-1-Clause",
-    "BSD-2-Clause",
-    "BSD-3-Clause",
-    "BSL-1.0",
-    "CC0-1.0",
-    "CDLA-Permissive-2.0",
-    "GPL-3.0",
-    "GPL-3.0-only",
-    "ISC",
-    "LGPL-2.1-or-later",
-    "MIT",
-    "MIT-0",
-    "MPL-2.0",
-    "Unicode-3.0",
-    "Unlicense",
-    "Zlib",
-    "0BSD",
+	"0BSD",
+	"Apache-2.0 WITH LLVM-exception",
+	"Apache-2.0",
+	"BSD-1-Clause",
+	"BSD-2-Clause",
+	"BSD-3-Clause",
+	"BSL-1.0",
+	"CC0-1.0",
+	"CDLA-Permissive-2.0",
+	"GPL-3.0",
+	"GPL-3.0-only",
+	"ISC",
+	"LGPL-2.1-or-later",
+	"MIT",
+	"MIT-0",
+	"MPL-2.0",
+	"Unicode-3.0",
+	"Unlicense",
+	"Zlib",
 ]
 
 # Some older crates use non-SPDX license expressions (e.g. "MIT/Apache-2.0"