chore(deps): bump the github-actions-dependencies group with 3 updates

.github/workflows/__generate-dependabot-config.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   main:
     uses: ./.github/workflows/generate-dependabot-config.yml

.github/workflows/__main-ci.yml

@@ -6,6 +6,9 @@ on:
     tags: ["*"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/__pull-request-ci.yml

@@ -5,6 +5,11 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+  packages: read
+  statuses: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/__shared-ci.yml

@@ -3,6 +3,11 @@ name: Internal - Common Continuous Integration tasks
 on:
   workflow_call:
 
+permissions:
+  contents: read
+  packages: read
+  statuses: write
+
 jobs:
   linter:
     uses: ./.github/workflows/linter.yml

.github/workflows/__test-action-matrix-outputs.yml

@@ -3,6 +3,9 @@ name: Internal - Tests for set/get matrix outputs
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests-1:
     name: Arrange - Set first output

.github/workflows/__test-action-repository-owner-is-organization.yml

@@ -3,6 +3,9 @@ name: Internal - Tests for repository-owner-is-organization action
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: Tests for repository-owner-is-organization action

.github/workflows/__test-action-slugify.yml

@@ -3,6 +3,9 @@ name: Internal - Tests for slugify action
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: Tests for slugify action

.github/workflows/generate-dependabot-config.yml

@@ -28,6 +28,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   generate-dependabot-config:
     name: Generate Dependabot Config

.github/workflows/greetings.yml

@@ -32,6 +32,11 @@ on:
       github-token:
         description: "Token for the repository. See https://github.com/actions/first-interaction#usage"
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   greeting:
     runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}

.github/workflows/linter.yml

@@ -17,6 +17,11 @@ on:
       github-token:
         description: 'Token for marking the status of linter run in the Checks section. See https://github.com/super-linter/super-linter#how-to-use'
 
+permissions:
+  contents: read
+  packages: read
+  statuses: write
+
 jobs:
   checks:
     runs-on: ${{ fromJson(inputs.runs-on) }}
@@ -27,7 +32,7 @@ jobs:
           fetch-depth: 0
 
       - name: 👕 Lint Code Base
-        uses: super-linter/super-linter/slim@v5
+        uses: super-linter/super-linter/slim@v6
         env:
           VALIDATE_ALL_CODEBASE: false
           LOG_LEVEL: WARN

.github/workflows/need-fix-to-issue.yml

@@ -9,6 +9,7 @@ on:
     branches:
       - "main"
   workflow_dispatch:
+    #checkov:skip=CKV_GHA_7: required
     inputs:
       manual-commit-ref:
         description: "The SHA of the commit to get the diff for"
@@ -32,14 +33,18 @@ on:
         type: string
         required: false
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   need-fix-to-issue:
     runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
     steps:
       - uses: "actions/checkout@v4"
 
       - name: "TODO to Issue"
-        uses: "alstr/todo-to-issue-action@v4.12"
+        uses: "alstr/todo-to-issue-action@v4.13"
         with:
           IDENTIFIERS: |
             [

.github/workflows/release-actions.yml

@@ -29,6 +29,9 @@ on:
       github-app-key:
         description: "GitHub App private key to generate GitHub token in place of github-token. See https://github.com/actions/create-github-app-token"
 
+permissions:
+  contents: read
+
 jobs:
   prepare-release:
     runs-on: ${{ fromJson(inputs.runs-on) }}
@@ -47,7 +50,7 @@ jobs:
 
       - id: changed-files
         if: ${{ inputs.update-all == false }}
-        uses: tj-actions/changed-files@v42.0.2
+        uses: tj-actions/changed-files@v44.0.0
         with:
           files: |
             ./actions/*

.github/workflows/stale.yml

@@ -41,6 +41,10 @@ on:
         type: string
         required: false
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}

Dockerfile

@@ -1,5 +1,10 @@
+#checkov:skip=CKV_DOCKER_2: required
 FROM ghcr.io/super-linter/super-linter:slim-v6
 
+ARG UID=1000
+ARG GID=1000
+USER ${UID}:${GID}
+
 ENV RUN_LOCAL=true 
 ENV USE_FIND_ALGORITHM=true
 ENV LOG_LEVEL=WARN

Makefile

@@ -7,7 +7,7 @@ lint: ## Execute linting
 	DEFAULT_WORKSPACE="$(CURDIR)"; \
 	LINTER_IMAGE="linter:latest"; \
 	VOLUME="$$DEFAULT_WORKSPACE:$$DEFAULT_WORKSPACE"; \
-	docker build --tag $$LINTER_IMAGE .; \
+	docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g)  --tag $$LINTER_IMAGE .; \
 	docker run \
 		-e DEFAULT_WORKSPACE="$$DEFAULT_WORKSPACE" \
 		-e FILTER_REGEX_INCLUDE="$(filter-out $@,$(MAKECMDGOALS))" \