Update actions-riff-raff to v4

actions-riff-raff v4 comments on the PR with some useful links for
deploying, so I’d like to update to it. I’ve followed the changes
described in [the
readme](https://github.com/guardian/actions-riff-raff/blob/6ddd4acd261c4265995908a68f0592ad1604b56e/README.md#L267-L286)
for migrating from v3 to v4, and copied the necessary changes for v3 as
well (to do with commenting on the PR).

.github/workflows/ci.yml

@@ -10,9 +10,12 @@ jobs:
     build:
         runs-on: ubuntu-20.04
 
-        permissions: # required by aws-actions/configure-aws-credentials
+        permissions:
+            # Allow GitHub to request an OIDC JWT ID token, for exchange with AWS Security Token Service (STS)
+            # See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#updating-your-github-actions-workflow
             id-token: write
             contents: read
+            pull-requests: write
 
         steps:
             # Seed the build number with last number from TeamCity.
@@ -30,12 +33,6 @@ jobs:
                   java-version: "11"
                   cache: "sbt"
 
-            - name: AWS Auth
-              uses: aws-actions/configure-aws-credentials@v4
-              with:
-                  role-to-assume: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
-                  aws-region: eu-west-1
-
             - name: Install Node
               uses: actions/setup-node@v3
               with:
@@ -54,11 +51,13 @@ jobs:
               run: |
                   sbt clean compile test Debian/packageBin
 
-            - uses: guardian/actions-riff-raff@v2
+            - uses: guardian/actions-riff-raff@v4
               with:
                   projectName: Editorial Tools::Workflow::Workflow Frontend
+                  roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
+                  githubToken: ${{ secrets.GITHUB_TOKEN }}
                   buildNumber: ${{ env.BUILD_NUMBER }}
                   configPath: conf/riff-raff.yaml
                   contentDirectories: |
                       workflow-frontend:
-                        - target/workflow-frontend_0.1_all.deb
+                        - target/workflow-frontend_0.1_all.deb