chore/security: clean using best practices

Author: issam71100

.github/workflows/release.yml

@@ -1,8 +1,15 @@
 name: build image on release
+
 on:
   workflow_dispatch:
   release:
     types: [published]
+
+permissions:
+  contents: read
+  packages: write
+  security-events: write
+
 jobs:
   extract-release-info:
     runs-on: ubuntu-latest
@@ -26,24 +33,25 @@ jobs:
             VERSION="${BASH_REMATCH[2]}"
             echo "Extracted project: $PROJECT, version: $VERSION"
           else
-            echo "Invalid release name format. Expected: 'project-version'"
+            echo "::error::Invalid release name format. Expected: 'project-version'"
+            echo "::error::Received: '$RELEASE_NAME'"
             exit 1
           fi
           
           CONFIG_FILE=".github/config/build-matrices.yaml"
           
           # Check if project exists in YAML
           if ! yq eval ".projects | has(\"$PROJECT\")" "$CONFIG_FILE" | grep -q "true"; then
-            echo "Project '$PROJECT' is not configured!"
-            echo "Available projects:"
+            echo "::error::Project '$PROJECT' is not configured!"
+            echo "::notice::Available projects:"
             yq eval '.projects | keys | .[]' "$CONFIG_FILE" | sed 's/^/  - /'
             exit 1
           fi
           
           # Validate version format (semantic versioning)
           if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?([-][A-Za-z0-9\.]+)*$ ]]; then
-            echo "Invalid version format: $VERSION"
-            echo "Expected semantic versioning format (e.g., 1.2.3, 1.2.3-beta)"
+            echo "::error::Invalid version format: $VERSION"
+            echo "::notice::Expected semantic versioning format (e.g., 1.2.3, 1.2.3-beta)"
             exit 1
           fi
           
@@ -53,7 +61,7 @@ jobs:
           INCLUDE_ARRAY=$(yq eval ".projects.${PROJECT}.include" "$CONFIG_FILE" -o=json -I=0)
           
           if [[ "$INCLUDE_ARRAY" == "null" ]]; then
-            echo "No include configuration found for project '$PROJECT'!"
+            echo "::error::No include configuration found for project '$PROJECT'!"
             exit 1
           fi
           
@@ -71,12 +79,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
 
-      - name: Set up JDK
-        uses: actions/setup-java@v5
-        with:
-          java-version: '21'
-          distribution: 'temurin'
-      
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -98,7 +100,7 @@ jobs:
         continue-on-error: true
         uses: aquasecurity/trivy-action@0.33.1
         with:
-          image-ref: 'ghcr.io/${{ github.repository_owner }}/${{ matrix.tag }}:${{ needs.extract-release-info.outputs.version }}'
+          image-ref: ghcr.io/${{ github.repository_owner }}/${{ matrix.tag }}:${{ needs.extract-release-info.outputs.version }}
           format: 'sarif'
           output: 'trivy-${{ matrix.name }}-image.sarif'
           severity: 'HIGH,CRITICAL'
@@ -117,4 +119,4 @@ jobs:
         with:
           name: ${{ matrix.artifact-name }}
           path: '*.sarif'
-          retention-days: 7
+          retention-days: 30