Add an explicit top-level permissions block to the GitHub Actions
workflows that were relying on the default token permissions. Each
workflow now defaults to contents: read, with additional scopes granted
only where a job needs them:
* nightly-trivy-scan keeps security-events: write at the job level to
upload SARIF results, plus contents: read for checkout.
* stale-issues gets issues: write and pull-requests: write for the
actions/stale action to label and close stale items.
Setting least-privilege permissions reduces the blast radius if a
workflow or one of its dependencies is compromised, and satisfies the
CLOMonitor token_permissions check.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix UT failures caused by client-go version bump.
* Some modifications to enhance the UT stability.
* Fix UT errors: non-constant format string in call to ...
* Fix linter issues.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
main branch will read go version from go.mod's go primitive, and
only keep major and minor version, because we want the actions to use
the lastest patch version automatically, even the go.mod specify version
like 1.24.0.
release branch can read the go version from go.mod file by setup-go
action's own logic.
Refactor the get Go version to reusable workflow.
Signed-off-by: Xun Jiang <xun.jiang@broadcom.com>
Shubham Pampattiwar
dependabot[bot]andGitHub
Xun Jiang