ci: upgrade super-linter to v8.5.0 (#14)

- Pin super-linter to v8.5.0 (SHA 61abc07d)
- Pin all GitHub Actions to SHA references
- Add persist-credentials: false to checkout steps
- Add permissions: read-all to workflow files
- Add dependabot cooldown and grouping configuration
- Disable new v8 linters not applicable to this repo
- Add FILTER_REGEX_EXCLUDE for nested .github directories
- Add zizmor ignore comments for reusable workflow refs
- Update markdownlint config for new rules
- Migrate ansible-lint-action to ansible/ansible-lint

Author: mbaldessari

.github/dependabot.yml

@@ -6,3 +6,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7

.github/linters/.markdown-lint.yml

@@ -0,0 +1,9 @@
+{
+    "default": true,
+    "MD003": false,
+    "MD013": false,
+    "MD033": false,
+    "MD059": false,
+    "MD060": false,
+    "MD034": false
+}

.github/workflows/conventional-pr.yml

@@ -1,6 +1,7 @@
 name: "Lint PR title"
 
 on:
+  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types:
       - opened
@@ -19,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
     - name: Install dependencies

.github/workflows/helm-lint.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 

.github/workflows/helm-unittest.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 

.github/workflows/superlinter.yml

@@ -2,7 +2,7 @@
   name: Super linter
 
   on: [push, pull_request]
-  permissions: read-all
+  permissions: read-all # zizmor: ignore[excessive-permissions]
 
   jobs:
     build:
@@ -13,16 +13,17 @@
 
       steps:
         - name: Checkout Code
-          uses: actions/checkout@v6
+          uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
           with:
+            persist-credentials: false
             # Full git history is needed to get a proper list of changed files within `super-linter`
             fetch-depth: 0
 
         ################################
         # Run Linter against code base #
         ################################
         - name: Lint Code Base
-          uses: super-linter/super-linter/slim@v7
+          uses: super-linter/super-linter/slim@61abc07d755095a68f4987d1c2c3d1d64408f1f9 # v8.5.0
           env:
             VALIDATE_ALL_CODEBASE: true
             DEFAULT_BRANCH: main
@@ -36,4 +37,14 @@
             VALIDATE_MARKDOWN_PRETTIER: false
             VALIDATE_YAML: false
             VALIDATE_YAML_PRETTIER: false
-  
+            VALIDATE_BIOME_FORMAT: false
+            VALIDATE_BIOME_LINT: false
+            VALIDATE_NATURAL_LANGUAGE: false
+            VALIDATE_SPELL_CODESPELL: false
+            VALIDATE_PYTHON_BLACK: false
+            VALIDATE_PYTHON_PYINK: false
+            VALIDATE_PYTHON_PYLINT: false
+            VALIDATE_PYTHON_RUFF_FORMAT: false
+            VALIDATE_SHELL_SHFMT: false
+            VALIDATE_TRIVY: false
+