Enable Renovate automerge and Zizmor CI

.github/actions/quay/action.yml

@@ -17,16 +17,20 @@ runs:
   using: 'composite'
   steps:
     - name: Log in to the Container registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: quay.io
         username: ${{ env.QUAY_USER }}
         password: ${{ env.QUAY_PASSWORD }}
     - name: Run command
       shell: bash
+      env:
+        ENTRYPOINT: ${{ inputs.entrypoint }}
+        COMMAND: ${{ inputs.run }}
+        OPTIONS: ${{ inputs.options }}
+        IMAGE: ${{ inputs.image }}
+        WORKSPACE: ${{ github.workspace }}
       run: |
-        export ENTRYPOINT='${{ inputs.entrypoint }}'
-        export COMMAND='${{ inputs.run }}'
         export COMMAND_PREFIX=''
 
         # Prep for a shell script.
@@ -38,15 +42,12 @@ runs:
         fi
 
         # Strip newlines in options.
-        export OPTIONS='${{ inputs.options }}'
         OPTIONS=${OPTIONS//$'\n'/ }
 
         # Sanitize the image name.
-        export IMAGE='${{ inputs.image }}'
         IMAGE=${IMAGE//$'\n'/}
 
         # Prep the workspace.
-        export WORKSPACE='${{ github.workspace }}'
         WORKSPACE=${WORKSPACE//$'\n'/}
 
         # Prep volumes.

.github/workflows/auto-approve-bot-prs.yml

@@ -0,0 +1,26 @@
+name: Renovate Auto-Approve
+
+on:
+  schedule:
+    - cron: "7 * * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: renovate-auto-approve
+
+jobs:
+  approve:
+    if: github.ref == 'refs/heads/main' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != ''
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Approve verified Renovate PRs
+        uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main
+        with:
+          app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }}
+          app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }}

.github/workflows/ci.yml

@@ -12,10 +12,32 @@ on:
   # Allows to run this via the Actions tab
   workflow_dispatch:
 
+permissions: {}
+
 env:
   REGISTRY: quay.io
 
 jobs:
+  workflow-security-lint:
+    name: Workflow security lint (Zizmor)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Audit workflows, composite actions, and Dependabot
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          advanced-security: false
+          version: 1.31.1
+          inputs: .
+          collect: workflows,actions,dependabot
+
   lint:
     permissions:
       # Required: allow read access to the content for analysis.
@@ -28,13 +50,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
           cache: false
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
         with:
           # Require: The version of golangci-lint to use.
           # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version.
@@ -43,16 +67,21 @@ jobs:
 
   check-license:
     name: License scan
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     timeout-minutes: 5
     env:
       REPORT_FILE: gl-license-scanning-report.json
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
+          cache: false
       - name: License scanning
         run: |
           go install github.com/google/go-licenses@latest
@@ -61,23 +90,28 @@ jobs:
         run: |
           go-licenses report . > licenses.csv
       - name: Save license scan report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: license_scanning
           path: licenses.csv
 
   check-go-releaser:
     name: Go releaser check
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
+          cache: false
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
         with:
           # either 'goreleaser' (default) or 'goreleaser-pro'
           distribution: goreleaser
@@ -87,21 +121,29 @@ jobs:
 
   test:
     name: Tests
+    permissions:
+      contents: read
     needs:
       - lint
+      - workflow-security-lint
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
+          cache: false
       - name: Run tests
         run: go test -v ./...
 
   publish:
     name: Publish the release
+    permissions:
+      contents: write
     if: ${{ github.ref_type == 'tag' }}
     needs:
       - test
@@ -114,26 +156,29 @@ jobs:
       QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
+          cache: false
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         if: github.event_name != 'pull_request'
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USER }}
           password: ${{ secrets.QUAY_PASSWORD }}
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         if: github.event_name != 'pull_request'
         with:
           registry: docker.io
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
       - name: Go releaser publish
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -146,10 +191,10 @@ jobs:
           version: v1.25.1
           args: release
       - name: Write latest version to file
-        run: mkdir -p dist && echo "${{ env.TAG }}" > dist/LATEST_VERSION
+        run: mkdir -p dist && printf '%s\n' "${TAG}" > dist/LATEST_VERSION
 
       - name: Authenticate with AWS
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/renovate.yml

@@ -0,0 +1,15 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0 1,8 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  renovate:
+    uses: StackVista/renovate-config/.github/workflows/renovate.yml@c5f974f5b7b1951c12daaa63b607d9eecc2574d3 # main
+    secrets:
+      RENOVATE_GH_APP_PRIVATE_KEY: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }}

renovate.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "github>StackVista/renovate-config",
+    "github>StackVista/renovate-config:go",
+    "github>StackVista/renovate-config:docker",
+    "github>StackVista/renovate-config:automerge"
+  ]
+}