Fixed security vulnerabilities & improvements (#2437)

## Changes
- Instead of referencing the shared workflow via
`Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main`,
switch to a local reference
(`./.github/workflows/shared_setup_env.yml`). This removes the
dependency on updating and merging the shared workflow first before
applying changes in the caller. With this approach, both workflows can
be updated together within a single PR.
- Also, this removes the [security
warning](https://github.com/Open-CMSIS-Pack/devtools/security/code-scanning?query=is%3Aopen+branch%3Amain+tool%3AScorecard)
to pin the workflow to a specific commit.
- Pinned dependencies in global.yml to updated versions.
- Added Pull request template file
- Scorecard cron job schedule time changed, in order to avoid any
conflict

Author: soumeh01

.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## Fixes
+<!-- List the issue(s) this PR resolves -->
+-
+
+## Changes
+<!-- List the changes this PR introduces -->
+-
+
+## Checklist
+<!-- Put an `x` in the boxes. All tasks must be completed and boxes checked before merging. -->
+- [ ] 🤖 This change is covered by unit tests (if applicable).
+- [ ] 🤹 Manual testing has been performed (if necessary).
+- [ ] 🛡️ Security impacts have been considered (if relevant).
+- [ ] 📖 Documentation updates are complete (if required).
+- [ ] 🧠 Third-party dependencies and TPIP updated (if required).

.github/workflows/buildmgr.yml

@@ -40,13 +40,13 @@ permissions:
 
 jobs:
   setup:
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
+    uses: ./.github/workflows/shared_setup_env.yml
     with:
       run_if: ${{ fromJSON((github.event_name == 'pull_request') || (github.event_name == 'workflow_dispatch') || (github.event_name == 'release' && startsWith(github.ref, 'refs/tags/tools/buildmgr/')) || ((github.event.schedule != '') && (!github.event.repository.private))) }}
 
   matrix_prep:
     needs: setup
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_matrix_prep.yml@main
+    uses: ./.github/workflows/shared_matrix_prep.yml
     with:
       workflow_name: buildmgr
 
@@ -140,7 +140,7 @@ jobs:
           sudo apt-get install ninja-build python3
           wget -q http://security.ubuntu.com/ubuntu/pool/main//d/doxygen/doxygen_1.8.6-2_amd64.deb
           sudo dpkg -i doxygen_1.8.6-2_amd64.deb
-          sudo pip install LinkChecker
+          sudo pip install LinkChecker==10.6.0
       - name: Create build folder
         run: mkdir build
 

.github/workflows/global.yaml

@@ -23,7 +23,7 @@ jobs:
       - name: Check copyright notice
         run: |
           pip install \
-            pre-commit \
-            python-magic==0.4.18 \
-            comment-parser>=1.2.3
+            pre-commit==4.5.1 \
+            python-magic==0.4.24 \
+            comment-parser==1.2.4
           pre-commit run --all-files

.github/workflows/nightly.yml

@@ -11,27 +11,27 @@ permissions:
 jobs:
   buildmgr:
     if: github.repository == 'Open-CMSIS-Pack/devtools'
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/buildmgr.yml@main
+    uses: ./.github/workflows/buildmgr.yml
     secrets: inherit
   packchk:
     needs: [buildmgr]
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/packchk.yml@main
+    uses: ./.github/workflows/packchk.yml
     secrets: inherit
   packgen:
     needs: [packchk]
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/packgen.yml@main
+    uses: ./.github/workflows/packgen.yml
     secrets: inherit
   projmgr:
     needs: [packgen]
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/projmgr.yml@main
+    uses: ./.github/workflows/projmgr.yml
     secrets: inherit
   svdconv:
     needs: [projmgr]
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/svdconv.yml@main
+    uses: ./.github/workflows/svdconv.yml
     secrets: inherit
   test_libs:
     needs: [svdconv]
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/test_libs.yml@main
+    uses: ./.github/workflows/test_libs.yml
   coverage:
     runs-on: ubuntu-22.04
     needs: [ buildmgr, packchk, packgen, projmgr, svdconv, test_libs ]

.github/workflows/packchk.yml

@@ -45,13 +45,13 @@ permissions:
 
 jobs:
   setup:
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
+    uses: ./.github/workflows/shared_setup_env.yml
     with:
       run_if: ${{ fromJSON((github.event_name == 'pull_request') || (github.event_name == 'workflow_dispatch') || (github.event_name == 'release' && startsWith(github.ref, 'refs/tags/tools/packchk/')) || ((github.event.schedule != '') && (!github.event.repository.private))) }}
 
   matrix_prep:
     needs: setup
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_matrix_prep.yml@main
+    uses: ./.github/workflows/shared_matrix_prep.yml
     with:
       workflow_name: packchk
 

.github/workflows/packgen.yml

@@ -40,13 +40,13 @@ permissions:
 
 jobs:
   setup:
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
+    uses: ./.github/workflows/shared_setup_env.yml
     with:
       run_if: ${{ fromJSON((github.event_name == 'pull_request') || (github.event_name == 'workflow_dispatch') || (github.event_name == 'release' && startsWith(github.ref, 'refs/tags/tools/packgen/')) || ((github.event.schedule != '') && (!github.event.repository.private))) }}
 
   matrix_prep:
     needs: setup
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_matrix_prep.yml@main
+    uses: ./.github/workflows/shared_matrix_prep.yml
     with:
       workflow_name: packgen
 

.github/workflows/projmgr.yml

@@ -44,21 +44,21 @@ permissions:
 
 jobs:
   setup:
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
+    uses: ./.github/workflows/shared_setup_env.yml
     with:
       run_if: ${{ fromJSON((github.event_name == 'pull_request') || (github.event_name == 'workflow_dispatch') || (github.event_name == 'release' && startsWith(github.ref, 'refs/tags/tools/projmgr/')) || ((github.event.schedule != '') && (!github.event.repository.private))) }}
 
   matrix_prep:
     needs: setup
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_matrix_prep.yml@main
+    uses: ./.github/workflows/shared_matrix_prep.yml
     with:
       workflow_name: projmgr
 
   build:
     needs: [ setup, matrix_prep ]
     runs-on: ${{ matrix.runs_on }}
     name: build (${{ matrix.runs_on }},${{ matrix.arch }})
-    timeout-minutes: 15
+    timeout-minutes: 20
     strategy:
       # fail-fast: true
       matrix: ${{ fromJson(needs.matrix_prep.outputs.matrix) }}
@@ -136,7 +136,7 @@ jobs:
     needs: [ setup, matrix_prep ]
     name: build-swig (${{ matrix.runs_on }}, ${{ matrix.arch }})
     runs-on: ${{ matrix.runs_on }}
-    timeout-minutes: 15
+    timeout-minutes: 20
     strategy:
       # fail-fast: true
       matrix: ${{ fromJson(needs.matrix_prep.outputs.matrix) }}

.github/workflows/scorecard.yml

@@ -6,7 +6,7 @@ on:
   # To guarantee Maintained check is occasionally updated. See
   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
   schedule:
-    - cron: '0 0 * * *'
+    - cron: '0 6 * * *'
   push:
     branches: [ "main" ]
   workflow_dispatch:

.github/workflows/svdconv.yml

@@ -37,13 +37,13 @@ permissions:
 
 jobs:
   setup:
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
+    uses: ./.github/workflows/shared_setup_env.yml
     with:
       run_if: ${{ fromJSON((github.event_name == 'pull_request') || (github.event_name == 'workflow_dispatch') || (github.event_name == 'release' && startsWith(github.ref, 'refs/tags/tools/svdconv/')) || ((github.event.schedule != '') && (!github.event.repository.private))) }}
 
   matrix_prep:
     needs: setup
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_matrix_prep.yml@main
+    uses: ./.github/workflows/shared_matrix_prep.yml
     with:
       workflow_name: svdconv
 

.github/workflows/test_libs.yml

@@ -29,13 +29,13 @@ permissions:
 
 jobs:
   setup:
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_setup_env.yml@main
+    uses: ./.github/workflows/shared_setup_env.yml
     with:
       run_if: ${{ ((github.event.schedule != '') && github.event.repository.private) == false }}
 
   matrix_prep:
     needs: setup
-    uses: Open-CMSIS-Pack/devtools/.github/workflows/shared_matrix_prep.yml@main
+    uses: ./.github/workflows/shared_matrix_prep.yml
     with:
       workflow_name: test_libs