Merge branch 'master' into Dockerfile_queries_fix_for_case_insensitivity

Author: cx-andre-pereira

.github/dependabot.yml

@@ -7,10 +7,13 @@ on:
     paths:
       - "internal/console/assets/*-flags.json"
 
+permissions:
+  contents: read
+
 jobs:
   notification-update-flags:
     name: Send email with flag changes
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
 
     steps:
       - name: Checkout project

.github/workflows/alert-update-flags.yaml

@@ -5,10 +5,13 @@ on:
     - cron: "0 0 * * 0"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   notification-update-flags:
     name: Send email with terraform modules updates
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -25,7 +28,7 @@ jobs:
             -c assets/libraries/common.json \
             -u https://registry.terraform.io/v1/modules
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v6
+        uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1
         with:
           title: "feat(queries): update terraform registry data on commons.json"
           token: ${{ secrets.KICS_BOT_PAT }}

.github/workflows/alert-update-terraform-modules.yaml

@@ -12,7 +12,7 @@ env:
 jobs:
   build:
     if: (github.event.label.name == 'cesar' && github.event.pull_request.mergeable == true)
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/cesar.yaml

@@ -4,9 +4,12 @@ on:
     types: [opened, synchronize, edited, reopened]
     branches:
       - master
+permissions:
+  contents: read
+
 jobs:
   check-license:
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
     env:
       BODY: ${{ github.event.pull_request.body }}
       USERNAME: ${{ github.event.pull_request.user.login }}
@@ -33,7 +36,7 @@ jobs:
         fi
     - name: Delete comment if license is fixed
       if: env.TAG_EXISTS == 'true'
-      uses: thollander/actions-comment-pull-request@e4a76dd2b0a3c2027c3fd84147a67c22ee4c90fa
+      uses: step-security/actions-comment-pull-request@60cd38988a354b2d22b47612fb02a20e822d6048 # v3.0.2
       with:
         message: |
           Deleting comment...
@@ -42,7 +45,7 @@ jobs:
         github-token: ${{ secrets.KICS_BOT_PAT }}
     - name: Add comment if no license
       if: env.CHECK_FAILED == 'true'
-      uses: thollander/actions-comment-pull-request@e4a76dd2b0a3c2027c3fd84147a67c22ee4c90fa
+      uses: step-security/actions-comment-pull-request@60cd38988a354b2d22b47612fb02a20e822d6048 # v3.0.2
       with:
         file-path: .github/scripts/pr-issue-info/apache-check.md
         comment-tag: apache_license

.github/workflows/check-apache-license.yaml

@@ -4,10 +4,13 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: generate-coverage
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
     outputs:
       coverage: ${{ steps.testcov.outputs.coverage }}
       color: ${{ steps.testcov.outputs.color }}

.github/workflows/check-go-coverage.yaml

@@ -13,7 +13,7 @@ env:
 jobs:
   build:
     if: github.event.pull_request.merged == true
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/ci-projects.yaml

@@ -5,10 +5,13 @@ on:
     branches:
       - "master"
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: generate-coverage
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
     outputs:
       coverage: ${{ steps.testcov.outputs.coverage }}
       color: ${{ steps.testcov.outputs.color }}
@@ -42,8 +45,10 @@ jobs:
           name: ${{ runner.os }}-coverage-latest
           path: coverage.html
   publish:
+    permissions:
+      contents: write  # for Git to git push
     name: publish-coverage
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
     needs: coverage
     steps:
       - name: Checkout Source

.github/workflows/go-ci-coverage.yaml

@@ -4,13 +4,19 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   integration-tests:
+    permissions:
+      actions: write  # for fkirc/skip-duplicate-actions to skip or stop workflow runs
+      contents: read  # for docker/build-push-action to read repo content
     name: integration-tests
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
     steps:
       - id: skip_check
-        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1
+        uses: step-security/skip-duplicate-actions@4eef6ae57f2ca5ea100e5c1da2ead9138483f53c # v5.3.4
         with:
           cancel_others: false
           paths_ignore: '["docs/**", "**/**.md", "examples"]'
@@ -20,7 +26,7 @@ jobs:
           persist-credentials: false
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0
       - name: Cache Docker layers
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
@@ -32,7 +38,7 @@ jobs:
         run: echo "GITHUB_SHA_SHORT=$(echo $GITHUB_SHA | cut -c 1-8)" >> $GITHUB_ENV
       - name: Build
         id: docker_build
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: step-security/docker-build-push-action@846549baaf047e867d038826129a64d81df0f704 # v7.1.0
         with:
           load: true
           context: ./

.github/workflows/go-ci-integration.yml

@@ -6,10 +6,13 @@ on:
     branches: [master]
     paths:
       - "assets/queries/**/metadata.json"
+permissions:
+  contents: read
+
 jobs:
   metrics:
     name: test-metrics
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout Source
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -31,8 +34,10 @@ jobs:
           name: ${{ runner.os }}-queries-badge-latest
           path: queries.svg
   publish:
+    permissions:
+      contents: write  # for Git to git push
     name: publish-metrics
-    runs-on: ubuntu-latest
+    runs-on: cx-public-ubuntu-x64
     needs: metrics
     steps:
       - name: Checkout Source