Address Scorecard Token-Permissions and Pinned-Dependencies (#633)

On-behalf-of: @SAP marko.mudrinic@sap.com

Signed-off-by: Marko Mudrinić <mudrinic.mare@gmail.com>

Author: xmudrii

.github/workflows/auto-labeler.yml

@@ -8,10 +8,12 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
-  issues: write
 
 jobs:
   auto-labeler:
     if: github.event.pull_request.head.repo.full_name == github.repository
-    uses: platform-mesh/.github/.github/workflows/job-auto-labeler.yml@main
+    uses: platform-mesh/.github/.github/workflows/job-auto-labeler.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   lint:
-    uses: platform-mesh/.github/.github/workflows/job-golang-lint.yml@main
+    uses: platform-mesh/.github/.github/workflows/job-golang-lint.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
     with:
       useTask: true
 
@@ -25,7 +25,7 @@ jobs:
       runsOn: 'ubuntu-latest-large'
 
   docker-build:
-    uses: platform-mesh/.github/.github/workflows/job-docker-build.yml@main
+    uses: platform-mesh/.github/.github/workflows/job-docker-build.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
     with:
       imageTagName: ghcr.io/platform-mesh/platform-mesh-operator
 

.github/workflows/ossf-scorecard.yml

@@ -1,18 +1,19 @@
 name: OpenSSF Scorecard
 on:
-    push:
-        branches: [main]
-    schedule:
-        - cron: '30 4 * * 1'
-    workflow_dispatch:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '30 4 * * 1'
+  workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
-    scorecard:
-        uses: platform-mesh/.github/.github/workflows/job-ossf-scorecard.yml@main
-        permissions:
-            security-events: write
-            id-token: write
-            contents: read
-            actions: read
+  scorecard:
+    uses: platform-mesh/.github/.github/workflows/job-ossf-scorecard.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read

.github/workflows/release.yml

@@ -6,20 +6,15 @@ on:
       - main
 
 permissions:
-  contents: write
-  id-token: write
-  issues: write
-  packages: write
-  pull-requests: write
-  attestations: write
+  contents: read
 
 concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
   lint:
-    uses: platform-mesh/.github/.github/workflows/job-golang-lint.yml@main
+    uses: platform-mesh/.github/.github/workflows/job-golang-lint.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
     with:
       useTask: true
 
@@ -30,21 +25,27 @@ jobs:
       runsOn: 'ubuntu-latest-large'
 
   create-version:
-    uses: platform-mesh/.github/.github/workflows/job-create-version.yml@main
+    uses: platform-mesh/.github/.github/workflows/job-create-version.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
     secrets: inherit
+    permissions:
+      contents: write
 
   docker-build-push:
     needs: [create-version, lint, test]
-    uses: platform-mesh/.github/.github/workflows/job-docker-build-push.yml@main
+    uses: platform-mesh/.github/.github/workflows/job-docker-build-push.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
+    secrets: inherit
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
     with:
       imageTagName: ghcr.io/platform-mesh/platform-mesh-operator
       version: ${{ needs.create-version.outputs.version }}
       multiarch: true
-    secrets: inherit
 
   update-version:
     needs: [create-version, docker-build-push]
-    uses: platform-mesh/.github/.github/workflows/job-chart-version-update.yml@main
+    uses: platform-mesh/.github/.github/workflows/job-chart-version-update.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
     secrets: inherit
     with:
       appVersion: ${{ needs.create-version.outputs.version }}
@@ -53,14 +54,20 @@ jobs:
 
   sbom:
     needs: [create-version, docker-build-push]
-    uses: platform-mesh/.github/.github/workflows/job-sbom.yml@main
+    uses: platform-mesh/.github/.github/workflows/job-sbom.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
+    permissions:
+      contents: read
+      packages: read
     with:
       imageReference: ghcr.io/platform-mesh/platform-mesh-operator:${{ needs.create-version.outputs.version }}
 
   image-ocm:
     needs: [create-version, docker-build-push, sbom]
-    uses: platform-mesh/.github/.github/workflows/job-image-ocm.yml@main
+    uses: platform-mesh/.github/.github/workflows/job-image-ocm.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0
     secrets: inherit
+    permissions:
+      contents: read
+      packages: write
     with:
       imageReference: ghcr.io/platform-mesh/platform-mesh-operator:${{ needs.create-version.outputs.version }}
       appVersion: ${{ needs.create-version.outputs.version }}