Update GHA workflows to match development branch

Author: gtopper

.github/workflows/pr.yaml

@@ -20,12 +20,27 @@ on:
       - development
       - 'integ_[0-9]+\.[0-9]+'
 
+permissions:
+  contents: read
+
 jobs:
+  fail-if-unsafe:
+    runs-on: ubuntu-latest
+    if: ${{ !contains( github.event.pull_request.labels.*.name, 'safe-to-test') }}
+    steps:
+      - name: Fail if not marked as safe to test
+        run: |
+          echo "CI will not run on a PR unless it has the safe-to-test label applied"
+          exit 1
   test-go:
     name: Lint & test Go code
     runs-on: [ self-hosted, Linux ]
+    if: ${{ contains( github.event.pull_request.labels.*.name, 'safe-to-test') }}
     container:
-      image: golang:1.19
+      image: golang:1.24-alpine
+      credentials:
+        username: ${{ secrets.DOCKER_HUB_USERNAME }}
+        password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
     steps:
       - name: Dump github context
@@ -41,10 +56,13 @@ jobs:
       - name: Dump github ref
         run: echo "$GITHUB_REF"
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: refs/pull/${{ github.event.number }}/merge
 
+      - name: Install Make
+        run: apk add make
+
       - name: Lint
         run: make lint
 
@@ -58,8 +76,12 @@ jobs:
   test-py:
     name: Lint & test Python code
     runs-on: [ self-hosted, Linux ]
+    if: ${{ contains( github.event.pull_request.labels.*.name, 'safe-to-test') }}
     container:
-      image: python:3.9.18
+      image: python:3.11.11
+      credentials:
+        username: ${{ secrets.DOCKER_HUB_USERNAME }}
+        password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
     steps:
       - name: Dump github context
@@ -75,7 +97,7 @@ jobs:
       - name: Dump github ref
         run: echo "$GITHUB_REF"
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: refs/pull/${{ github.event.number }}/merge
 
@@ -87,7 +109,7 @@ jobs:
 
       - uses: actions/setup-go@v3
         with:
-          go-version: "^1.19.13"
+          go-version: "^1.24.3"
 
       - name: Run Python tests
         run: make test-py

.github/workflows/release.yaml

@@ -19,12 +19,18 @@ on:
     types:
       - created
 
+permissions:
+  contents: write
+
 jobs:
   test-go:
     name: Lint & test Go code
     runs-on: [ self-hosted, Linux ]
     container:
-      image: golang:1.19
+      image: golang:1.24-alpine
+      credentials:
+        username: ${{ secrets.DOCKER_HUB_USERNAME }}
+        password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
     steps:
       - name: Dump github context
@@ -40,7 +46,10 @@ jobs:
       - name: Dump github ref
         run: echo "$GITHUB_REF"
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+
+      - name: Install Make
+        run: apk add make
 
       # This gets killed, probably due to memory usage
       # - name: Lint
@@ -57,7 +66,10 @@ jobs:
     name: Lint & test Python code
     runs-on: [ self-hosted, Linux ]
     container:
-      image: python:3.9.18
+      image: python:3.11.11
+      credentials:
+        username: ${{ secrets.DOCKER_HUB_USERNAME }}
+        password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
     env:
       V3IO_API: ${{ secrets.V3IO_API }}
@@ -78,7 +90,7 @@ jobs:
       - name: Dump github ref
         run: echo "$GITHUB_REF"
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Install dependencies
         run: make python-deps
@@ -88,7 +100,7 @@ jobs:
 
       - uses: actions/setup-go@v3
         with:
-          go-version: "^1.19.13"
+          go-version: "^1.24.3"
 
       - name: Run Python tests
         run: make test-py
@@ -115,11 +127,11 @@ jobs:
       - name: Dump github ref
         run: echo "$GITHUB_REF"
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-go@v3
         with:
-          go-version: "^1.19.13"
+          go-version: "^1.24.3"
 
       - name: Build binaries for ${{ matrix.go-os }}
         run: make frames-bin
@@ -186,7 +198,7 @@ jobs:
       - release-docker-internal
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up python ${{ matrix.python-version }}
         uses: actions/setup-python@v4