NO-ISSUE: Remove unnecessary GH workflows and fix sec advisories (#217)

Signed-off-by: Ricardo Zanini <ricardozanini@gmail.com>
serverlessworkflow · Dec 23, 2024 · bc3336e · bc3336e
1 parent e2f1f94
commit bc3336e
Show file tree

Hide file tree

Showing 9 changed files with 21 additions and 132 deletions.
diff --git a/.github/labeler.yml b/.github/labeler.yml
@@ -12,5 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-source:
-  - '**/*'
+"documentation :notebook:":
+  - changed-files:
+      - any-glob-to-any-file: ['contrib/*', '**/*.md']
+kubernetes:
+  - changed-files:
+      - any-glob-to-any-file: ['kubernetes/*', 'hack/builder-gen.sh', 'hack/deepcopy-gen.sh', 'Makefile']
diff --git a/.github/labels.yml b/.github/labels.yml
diff --git a/.github/workflows/Go-SDK-Check-k8s-integration.yaml b/.github/workflows/Go-SDK-Check-k8s-integration.yaml
@@ -22,6 +22,10 @@ on:
       - "Makefile"
     branches:
       - main
+
+permissions:
+  contents: read
+
 env:
   GO_VERSION: 1.22
 jobs:

diff --git a/.github/workflows/Go-SDK-PR-Check.yaml b/.github/workflows/Go-SDK-PR-Check.yaml
@@ -22,6 +22,10 @@ on:
       - "Makefile"
     branches:
       - main
+
+permissions:
+  contents: read
+
 env:
   GO_VERSION: 1.22
 jobs:
@@ -67,7 +71,7 @@ jobs:
           changed_files=$(git status -s | grep -v 'go.mod\|go.sum\|tools.mod\|tools.sum' || :)
           [[ -z "$changed_files" ]] ||  (printf "Some files are not formatted properly: \n$changed_files\n Did you run 'make test' before sending the PR?" && exit 1)
       - name: Check lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1 - Please ALWAYS use SHA to avoid GH sec issues
         with:
           version: latest
       - name: Install cover

diff --git a/.github/workflows/prow_commands.yml b/.github/workflows/prow_commands.yml
diff --git a/.github/workflows/prow_cron_pull_request_merge.yml b/.github/workflows/prow_cron_pull_request_merge.yml
diff --git a/.github/workflows/prow_remove_lgtm.yml b/.github/workflows/prow_remove_lgtm.yml
diff --git a/.github/workflows/pull_request_labeler.yml b/.github/workflows/pull_request_labeler.yml
@@ -14,15 +14,13 @@
 
 name: "Pull Request Labeler"
 on:
-- pull_request_target
+  - pull_request_target
 
 jobs:
-  triage:
+  labeler:
     permissions:
       contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v4.0.2
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+      - uses: actions/labeler@v5
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
@@ -16,7 +16,9 @@ name: Mark stale issues and pull requests
 on:
   schedule:
     - cron: "0 0 * * *"
-
+permissions:
+  issues: write
+  pull-requests: write
 jobs:
   stale:
     runs-on: ubuntu-latest