Merge branch 'idaholab:main' into main

Author: piercema

.github/workflows/api-build-and-push-ghcr.yml

@@ -21,6 +21,11 @@ on:
 jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
+    permissions:
+      actions: write
+      packages: write
+      contents: read
+      security-events: write
     with:
       service: api
       dockerfile: ./Dockerfiles/api.Dockerfile

.github/workflows/arkime-build-and-push-ghcr.yml

@@ -26,6 +26,11 @@ on:
 jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
+    permissions:
+      actions: write
+      packages: write
+      contents: read
+      security-events: write
     with:
       service: arkime
       dockerfile: ./Dockerfiles/arkime.Dockerfile

.github/workflows/dashboards-build-and-push-ghcr.yml

@@ -20,6 +20,11 @@ on:
 jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
+    permissions:
+      actions: write
+      packages: write
+      contents: read
+      security-events: write
     with:
       service: dashboards
       dockerfile: ./Dockerfiles/dashboards.Dockerfile

.github/workflows/dashboards-helper-build-and-push-ghcr.yml

@@ -21,6 +21,11 @@ on:
 jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
+    permissions:
+      actions: write
+      packages: write
+      contents: read
+      security-events: write
     with:
       service: dashboards-helper
       dockerfile: ./Dockerfiles/dashboards-helper.Dockerfile

.github/workflows/dirinit-build-and-push-ghcr.yml

@@ -15,6 +15,11 @@ on:
 jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
+    permissions:
+      actions: write
+      packages: write
+      contents: read
+      security-events: write
     with:
       service: dirinit
       dockerfile: ./Dockerfiles/dirinit.Dockerfile

.github/workflows/docker-build-push-scan.yml

@@ -40,14 +40,14 @@ jobs:
     steps:
       -
         name: Cancel previous run in progress
-        uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66
+        uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # v0.13.1
         with:
           ignore_sha: true
           all_but_latest: true
           access_token: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: 'recursive'
       -
@@ -77,20 +77,20 @@ jobs:
         id: extract_malcolm_version
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
         with:
           driver-opts: |
             image=moby/buildkit:master
       -
         name: Log in to registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           file: ${{ inputs.dockerfile }}
@@ -111,7 +111,7 @@ jobs:
         name: Run Trivy vulnerability scanner
         if: ${{ matrix.platform == 'linux/amd64' }}
         id: trivy-scan
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         env:
           TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
         with:
@@ -128,6 +128,6 @@ jobs:
       -
         name: Upload Trivy scan results to GitHub Security tab
         if: ${{ matrix.platform == 'linux/amd64' }}
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           sarif_file: 'trivy-results.sarif'

.github/workflows/file-upload-build-and-push-ghcr.yml

@@ -18,6 +18,11 @@ on:
 jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
+    permissions:
+      actions: write
+      packages: write
+      contents: read
+      security-events: write
     with:
       service: file-upload
       dockerfile: ./Dockerfiles/file-upload.Dockerfile

.github/workflows/filebeat-build-and-push-ghcr.yml

@@ -22,6 +22,11 @@ on:
 jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
+    permissions:
+      actions: write
+      packages: write
+      contents: read
+      security-events: write
     with:
       service: filebeat-oss
       dockerfile: ./Dockerfiles/filebeat.Dockerfile

.github/workflows/filescan-build-and-push-ghcr.yml

@@ -23,6 +23,11 @@ on:
 jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
+    permissions:
+      actions: write
+      packages: write
+      contents: read
+      security-events: write
     with:
       service: filescan
       dockerfile: ./Dockerfiles/filescan.Dockerfile

.github/workflows/freq-build-and-push-ghcr.yml

@@ -18,6 +18,11 @@ on:
 jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
+    permissions:
+      actions: write
+      packages: write
+      contents: read
+      security-events: write
     with:
       service: freq
       dockerfile: ./Dockerfiles/freq.Dockerfile