Pin sbt action to hash, revert permissions to read #6099

Annotations

4 warnings

"pull_request_target.edited" is not a known webhook name (https://developer.github.com/v3/activity/events/types/)

"pull_request_target.synchronize" is not a known webhook name (https://developer.github.com/v3/activity/events/types/)

"pull_request_target.reopened" is not a known webhook name (https://developer.github.com/v3/activity/events/types/)

"pull_request_target.opened" is not a known webhook name (https://developer.github.com/v3/activity/events/types/)