operator cloudnative-pg (1.30.2)

.github/workflows/command_merge.yaml

@@ -1,6 +1,11 @@
 
 on: issue_comment
 name: Issue Comments - merge
+
+permissions:
+  issues: write
+  pull-requests: write
+
 env:
   OPP_PRODUCTION_TYPE: "k8s"
   OPP_THIS_REPO_NAME: "community-operators"
@@ -14,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: labels
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -29,7 +34,7 @@ jobs:
 
       - name: Merge command handler
         id: command
-        uses: xt0rted/slash-command-action@v1
+        uses: xt0rted/slash-command-action@865ee04a1dfc8aa2571513eee8e84b5377153511  # v1.2.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           command: merge
@@ -39,7 +44,7 @@ jobs:
           permission-level: write
 
       - name: Merge message when not able to merge and inform user about authorized_changes
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: |
           steps.command.outputs.command-name == 'merge' &&
           steps.command.outputs.command-arguments == 'possible' &&
@@ -59,7 +64,7 @@ jobs:
             })
 
       - name: Message when automerge is disabled
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: |
           steps.command.outputs.command-name == 'merge' &&
           steps.command.outputs.command-arguments == 'possible' &&
@@ -75,7 +80,7 @@ jobs:
             })
 
       - name: Message when dco-failed is missing
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: |
           steps.command.outputs.command-name == 'merge' &&
           steps.command.outputs.command-arguments == 'possible' &&
@@ -92,7 +97,7 @@ jobs:
 
       - name: automerge
         if: steps.command.outputs.command-name == 'merge' && steps.command.outputs.command-arguments == 'possible'
-        uses: "pascalgn/automerge-action@v0.14.2"
+        uses: "pascalgn/automerge-action@01fb84a9d077930bf9d16d1f7fa3fe2ffe45aabe"  # v0.14.2
         env:
           GITHUB_TOKEN: "${{ secrets.FRAMEWORK_MERGE }}"
           MERGE_LABELS: "authorized-changes,package-validated,installation-validated,!do-not-merge/hold,!do-not-merge/work-in-progress,!automerge-disabled,!dco-failed"

.github/workflows/command_retest.yaml

@@ -1,6 +1,11 @@
 
 on: issue_comment
 name: Issue Comments - retest
+
+permissions:
+  issues: write
+  pull-requests: write
+
 env:
   OPP_PRODUCTION_TYPE: "k8s"
 
@@ -13,7 +18,7 @@ jobs:
     steps:
       - name: Restest command handler
         id: command
-        uses: xt0rted/slash-command-action@v1
+        uses: xt0rted/slash-command-action@865ee04a1dfc8aa2571513eee8e84b5377153511  # v1.2.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           command: retest
@@ -23,7 +28,7 @@ jobs:
           permission-level: read
 
       - name: Doing hold
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: |
           steps.command.outputs.command-name == 'retest'
         with:
@@ -37,12 +42,12 @@ jobs:
             })
 
       - name: Sleep for 10 seconds
-        uses: jakejarvis/wait-action@master
+        uses: jakejarvis/wait-action@919fc193e07906705e5b7a50f90ea9e74d20b2b0  # v0.1.1
         with:
           time: '10s'
 
       - name: Doing hold cancel
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: |
           steps.command.outputs.command-name == 'retest'
         with:

.github/workflows/dco_test.yaml

@@ -8,6 +8,11 @@ on:
       - master
       - main
 
+permissions:
+  contents: read
+  pull-requests: read
+  actions: write
+
 env:
   OPP_DEBUG: 1
   OPP_CONTAINER_OPT: "-t"
@@ -20,7 +25,7 @@ env:
   OPP_THIS_BRANCH: "main"
   OPP_PROD: 0
   OPP_DRY_RUN: 0
-  KIND_KUBE_VERSION: "v1.30.0"
+  KIND_KUBE_VERSION: "v1.32.8"
   OPP_PRODUCTION_TYPE: "k8s"
   OPP_REVIEWERS_ENABLED: 1
 
@@ -32,12 +37,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - id: files
-        uses: masesgroup/retrieve-changed-files@v2
+        uses: masesgroup/retrieve-changed-files@076a92699259d81d1c607bd91f0e1e9d45fd3151  # v2
         continue-on-error: true
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c  # v4.9.1
         with:
           python-version: '3.x'
       - name: Install dependencies
@@ -70,11 +77,11 @@ jobs:
     steps:
       - name: Get PR Commits
         id: 'get-pr-commits'
-        uses: tim-actions/get-pr-commits@master
+        uses: tim-actions/get-pr-commits@198af03565609bb4ed924d1260247b4881f09e7d  # v1.3.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: DCO Check
-        uses: tim-actions/dco@v1.0
+        uses: tim-actions/dco@864a05d479dd120ad795f99a23599f70d9c5ac63  # v1.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commits: ${{ steps.get-pr-commits.outputs.commits }}
@@ -94,7 +101,7 @@ jobs:
         run: |
           mkdir -p ./pr
           echo ${{ github.event.number }} > ./pr/NR
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: pr
           path: pr/

.github/workflows/dco_workflow_complete.yaml

@@ -6,6 +6,11 @@ on:
     workflows: ["DCO test"]
     types: [completed]
 
+permissions:
+  actions: read
+  issues: write
+  pull-requests: write
+
 env:
   OPP_PRODUCTION_TYPE: "k8s"
 
@@ -15,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Download artifact'
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -42,7 +47,7 @@ jobs:
           [ -z "$PR" ] && echo "Invalid PR number" && exit 1
           echo "pr=${PR}" >> $GITHUB_OUTPUT
 
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: pr-labels
         continue-on-error: true
         with:
@@ -64,7 +69,7 @@ jobs:
     steps:
       - name: "Removing dco-failed label"
         if: needs.pr.outputs.pr != '0'
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         continue-on-error: true
         env:
           PR: "${{ needs.pr.outputs.pr }}"
@@ -78,7 +83,7 @@ jobs:
               name: 'dco-failed'
             })
 
-      # - uses: actions/github-script@v6
+      # - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       #   if: |
       #     (!contains(fromJson(steps.pr-labels.outputs.result).*.name, 'do-not-merge/work-in-progress')) &&
       #     (!contains(fromJson(steps.pr-labels.outputs.result).*.name, 'do-not-merge/hold'))
@@ -100,7 +105,7 @@ jobs:
     steps:
 
       - name: "Setting dco-failed label"
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         continue-on-error: true
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}

.github/workflows/documentation.yaml

@@ -10,6 +10,10 @@ on:
         required: true
         default: '100'
 
+permissions:
+  contents: write
+
+
 env:
   OPP_THIS_REPO: "k8s-operatorhub/community-operators"
 
@@ -18,8 +22,9 @@ jobs:
     runs-on: ubuntu-latest
     container: quay.io/operator_testing/community-operators-mkdocs
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
+        persist-credentials: false
         repository: redhat-openshift-ecosystem/community-operators-pipeline
         ref: documentation
 
@@ -39,7 +44,7 @@ jobs:
 
         mkdocs build
     - name: Deploy
-      uses: peaceiris/actions-gh-pages@v3
+      uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847  # v3.9.3
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: ./site