chore(deps): bump the github-actions-dependencies group with 3 updates

Bumps the github-actions-dependencies group with 3 updates: [super-linter/super-linter](https://github.com/super-linter/super-linter), [alstr/todo-to-issue-action](https://github.com/alstr/todo-to-issue-action) and [tj-actions/changed-files](https://github.com/tj-actions/changed-files). Updates `super-linter/super-linter` from 5 to 6 - [Release notes](https://github.com/super-linter/super-linter/releases) - [Changelog](https://github.com/super-linter/super-linter/blob/main/CHANGELOG.md) - [Commits](super-linter/super-linter@v5...v6) Updates `alstr/todo-to-issue-action` from 4.12 to 4.13 - [Release notes](https://github.com/alstr/todo-to-issue-action/releases) - [Commits](alstr/todo-to-issue-action@v4.12...v4.13) Updates `tj-actions/changed-files` from 42.0.2 to 44.0.0 - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](tj-actions/changed-files@v42.0.2...v44.0.0) --- updated-dependencies: - dependency-name: super-linter/super-linter dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-dependencies - dependency-name: alstr/todo-to-issue-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies - dependency-name: tj-actions/changed-files dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Emilien Escalle <emilien.escalle@escemi.com>
hoverkraft-tech · Mar 31, 2024 · c82072b · c82072b
1 parent 5ffd5bc
commit c82072b
Show file tree

Hide file tree

Showing 15 changed files with 59 additions and 4 deletions.
diff --git a/.github/workflows/__generate-dependabot-config.yml b/.github/workflows/__generate-dependabot-config.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   main:
     uses: ./.github/workflows/generate-dependabot-config.yml

diff --git a/.github/workflows/__main-ci.yml b/.github/workflows/__main-ci.yml
@@ -6,6 +6,9 @@ on:
     tags: ["*"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

diff --git a/.github/workflows/__pull-request-ci.yml b/.github/workflows/__pull-request-ci.yml
@@ -5,6 +5,11 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+  packages: read
+  statuses: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

diff --git a/.github/workflows/__shared-ci.yml b/.github/workflows/__shared-ci.yml
@@ -3,6 +3,11 @@ name: Internal - Common Continuous Integration tasks
 on:
   workflow_call:
 
+permissions:
+  contents: read
+  packages: read
+  statuses: write
+
 jobs:
   linter:
     uses: ./.github/workflows/linter.yml

diff --git a/.github/workflows/__test-action-matrix-outputs.yml b/.github/workflows/__test-action-matrix-outputs.yml
@@ -3,6 +3,9 @@ name: Internal - Tests for set/get matrix outputs
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests-1:
     name: Arrange - Set first output

diff --git a/.github/workflows/__test-action-repository-owner-is-organization.yml b/.github/workflows/__test-action-repository-owner-is-organization.yml
@@ -3,6 +3,9 @@ name: Internal - Tests for repository-owner-is-organization action
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: Tests for repository-owner-is-organization action

diff --git a/.github/workflows/__test-action-slugify.yml b/.github/workflows/__test-action-slugify.yml
@@ -3,6 +3,9 @@ name: Internal - Tests for slugify action
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: Tests for slugify action

diff --git a/.github/workflows/generate-dependabot-config.yml b/.github/workflows/generate-dependabot-config.yml
@@ -28,6 +28,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   generate-dependabot-config:
     name: Generate Dependabot Config

diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml
@@ -32,6 +32,11 @@ on:
       github-token:
         description: "Token for the repository. See https://github.com/actions/first-interaction#usage"
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   greeting:
     runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}

diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
@@ -17,6 +17,11 @@ on:
       github-token:
         description: 'Token for marking the status of linter run in the Checks section. See https://github.com/super-linter/super-linter#how-to-use'
 
+permissions:
+  contents: read
+  packages: read
+  statuses: write
+
 jobs:
   checks:
     runs-on: ${{ fromJson(inputs.runs-on) }}
@@ -27,7 +32,7 @@ jobs:
           fetch-depth: 0
 
       - name: 👕 Lint Code Base
-        uses: super-linter/super-linter/slim@v5
+        uses: super-linter/super-linter/slim@v6
         env:
           VALIDATE_ALL_CODEBASE: false
           LOG_LEVEL: WARN

diff --git a/.github/workflows/need-fix-to-issue.yml b/.github/workflows/need-fix-to-issue.yml
@@ -9,6 +9,7 @@ on:
     branches:
       - "main"
   workflow_dispatch:
+    #checkov:skip=CKV_GHA_7: required
     inputs:
       manual-commit-ref:
         description: "The SHA of the commit to get the diff for"
@@ -32,14 +33,18 @@ on:
         type: string
         required: false
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   need-fix-to-issue:
     runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
     steps:
       - uses: "actions/checkout@v4"
 
       - name: "TODO to Issue"
-        uses: "alstr/todo-to-issue-action@v4.12"
+        uses: "alstr/todo-to-issue-action@v4.13"
         with:
           IDENTIFIERS: |
             [

diff --git a/.github/workflows/release-actions.yml b/.github/workflows/release-actions.yml
@@ -29,6 +29,9 @@ on:
       github-app-key:
         description: "GitHub App private key to generate GitHub token in place of github-token. See https://github.com/actions/create-github-app-token"
 
+permissions:
+  contents: read
+
 jobs:
   prepare-release:
     runs-on: ${{ fromJson(inputs.runs-on) }}
@@ -47,7 +50,7 @@ jobs:
 
       - id: changed-files
         if: ${{ inputs.update-all == false }}
-        uses: tj-actions/changed-files@v42.0.2
+        uses: tj-actions/changed-files@v44.0.0
         with:
           files: |
             ./actions/*

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -41,6 +41,10 @@ on:
         type: string
         required: false
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}

diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,10 @@
+#checkov:skip=CKV_DOCKER_2: required
 FROM ghcr.io/super-linter/super-linter:slim-v6
 
+ARG UID=1000
+ARG GID=1000
+USER ${UID}:${GID}
+
 ENV RUN_LOCAL=true 
 ENV USE_FIND_ALGORITHM=true
 ENV LOG_LEVEL=WARN

diff --git a/Makefile b/Makefile
@@ -7,7 +7,7 @@ lint: ## Execute linting
 	DEFAULT_WORKSPACE="$(CURDIR)"; \
 	LINTER_IMAGE="linter:latest"; \
 	VOLUME="$$DEFAULT_WORKSPACE:$$DEFAULT_WORKSPACE"; \
-	docker build --tag $$LINTER_IMAGE .; \
+	docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g)  --tag $$LINTER_IMAGE .; \
 	docker run \
 		-e DEFAULT_WORKSPACE="$$DEFAULT_WORKSPACE" \
 		-e FILTER_REGEX_INCLUDE="$(filter-out $@,$(MAKECMDGOALS))" \