chore(ci): harden CI pipelines and fix devcontainer (microsoft#2060)

## Description

Comprehensive CI hardening across all workflow files, devcontainer
fixes, and coverage reporting.

### Actions pinned to SHA
- Pin all 50+ GitHub Action references to SHA digests with version
comments
- Bump to latest versions: CodeQL v4.32.3, golangci-lint-action v9.2.0,
goreleaser-action v6.4.0, markdownlint-cli2-action v22.0.0, trivy-action
0.34.0, create-pull-request v8.1.0, stale v10.1.1, and others
- Eliminates supply chain risk from mutable version tags (including
`actions/stale@main`)

### Workflow hardening
- **Concurrency groups** added to 8 workflows to cancel duplicate runs
- **timeout-minutes** added to all 37 jobs across all workflows
- **Explicit permissions** added to workflows missing them
(commit-message, test-multicloud, markdownlint, release-validation)
- **Permissions reduced** in test.yaml (removed unnecessary
issues/pull-requests/security-events write)
- **Path filters** added to docs and markdownlint workflows

### Bug fixes
- **Trivy**: skip scan when triggering release workflow failed
(eliminates ~82% of trivy failures); use latest release tag for
scheduled/manual scans instead of HEAD SHA
- **Merge queue bypass removed**: golangci-lint and CodeQL now run on
merge_group events
- **Shell expansion fix**: `$(make version)` and `$(curl ...)` in YAML
`with:` blocks don't execute — restructured perf-schedule.yaml with a
`get-tag` job and fixed images.yaml perf-test calls
- **Release validation**: only runs when triggering workflow succeeded
- **Stale outputs**: quoted to prevent injection
- **Coverage scripts**: fixed hardcoded `owner = "azure"` →
`"microsoft"`, fixed workflow filename `"retina-test.yaml"` →
`"test.yaml"`, added guard for empty workflow runs
- **Makefile coverage target**: fixed grep pattern that silently failed
to filter `_generated.go` files (mixed escaped/unescaped `|` in BRE
mode)

### Test coverage reporting
- **Step summary**: every test run now posts total coverage percentage
and lowest-coverage packages to `$GITHUB_STEP_SUMMARY`
- **PR comment**: on pull requests, fetches main branch coverage, diffs
it, and posts/updates a coverage comparison comment showing per-file
increases/decreases
- Handles 403 gracefully for fork PRs (insufficient `GITHUB_TOKEN`
permissions) — falls back to step summary
- Wires up the existing but disconnected `scripts/coverage/`
infrastructure

### GoReleaser
- Added `checksum` and `sboms` sections for release artifact integrity

### Devcontainer
- Upgraded base image from Ubuntu Jammy (22.04) to Noble (24.04)
- Pinned Go version to 1.24.11 (matches go.mod)
- Fixed LLVM/Clang from version 14 to 16 (matches project requirements)
- Added `clang` and `llvm-strip` symlinks
- Installed `gofumpt` (required by `make fmt`)
- Added docker readiness check before `kind create cluster`
- Hardened install script with `set -euo pipefail`
- Removed redundant `common-utils` feature

## Related Issue

N/A — proactive hardening based on CI failure analysis.

## Checklist

- [x] I have read the [contributing
documentation](https://retina.sh/docs/Contributing/overview).
- [x] I signed and signed-off the commits (`git commit -S -s ...`).
- [x] I have correctly attributed the author(s) of the code.
- [x] I have tested the changes locally.
- [x] I have followed the project's style guidelines.
- [x] I have updated the documentation, if necessary.
- [x] I have added tests, if applicable.

## Screenshots (if applicable) or Testing Completed

- Verified zero unpinned actions remain (`grep` for `@v\d` and `@main`
returns no matches)
- Verified zero `IS_NOT_MERGE_GROUP` references remain
- Verified all 37 jobs have `timeout-minutes` set
- YAML syntax validated across all workflow files

Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>

Author: nddq

.devcontainer/devcontainer.json

@@ -1,16 +1,17 @@
 {
   "name": "retina",
-  "image": "mcr.microsoft.com/devcontainers/base:jammy",
+  "image": "mcr.microsoft.com/devcontainers/base:noble",
   "features": {
-    "ghcr.io/devcontainers/features/common-utils:2": {},
     "ghcr.io/devcontainers/features/docker-in-docker:2": {},
     "ghcr.io/devcontainers/features/github-cli:1": {},
-    "ghcr.io/devcontainers/features/go:1": {},
+    "ghcr.io/devcontainers/features/go:1": {
+      "version": "1.24.11"
+    },
     "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {},
-    "ghcr.io/devcontainers-contrib/features/kind:1": {},
+    "ghcr.io/devcontainers-extra/features/kind:1": {},
     "ghcr.io/devcontainers/features/azure-cli:1": {}
   },
-  "postCreateCommand": "bash .devcontainer/installMoreTools.sh && kind create cluster",
+  "postCreateCommand": "bash .devcontainer/installMoreTools.sh && while ! docker info >/dev/null 2>&1; do sleep 1; done && kind create cluster",
   "customizations": {
     "vscode": {
       "extensions": [

.devcontainer/installMoreTools.sh

@@ -1,8 +1,25 @@
 #!/bin/bash
+set -euo pipefail
+
+LLVM_VERSION=16
 
 # Install the required tools and dependencies
-sudo apt-get update && sudo apt-get install -y lsb-release wget software-properties-common gnupg clang-14 lldb-14 lld-14 clangd-14 man-db
+sudo apt-get update && sudo apt-get install -y \
+  lsb-release \
+  wget \
+  software-properties-common \
+  gnupg \
+  man-db
+
+# Install LLVM/Clang (version must match project requirements)
+curl -fsSL https://apt.llvm.org/llvm.sh -o /tmp/llvm.sh
+chmod +x /tmp/llvm.sh
+sudo /tmp/llvm.sh "$LLVM_VERSION"
+rm /tmp/llvm.sh
+
+# Create unversioned symlinks so the build system finds clang and llvm-strip
+sudo ln -sf "/usr/bin/clang-${LLVM_VERSION}" /usr/bin/clang
+sudo ln -sf "/usr/bin/llvm-strip-${LLVM_VERSION}" /usr/bin/llvm-strip
 
-# Install LLVM 14
-export LLVM_VERSION=14
-curl -sL https://apt.llvm.org/llvm.sh | sudo bash -s "$LLVM_VERSION"
+# Install gofumpt (used by make fmt)
+go install mvdan.cc/gofumpt@latest

.github/workflows/codeql.yaml

@@ -6,6 +6,14 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze
@@ -17,7 +25,6 @@ jobs:
         language: [go]
     runs-on: ubuntu-latest
     env:
-      IS_NOT_MERGE_GROUP: ${{ github.event_name != 'merge_group' }}
       GOOS: ${{ matrix.goos }}
       GOARCH: ${{ matrix.goarch }}
     timeout-minutes: 90
@@ -27,23 +34,18 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        if: env.IS_NOT_MERGE_GROUP
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup go
-        if: env.IS_NOT_MERGE_GROUP
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version-file: go.mod
       - name: Initialize CodeQL
-        if: env.IS_NOT_MERGE_GROUP
-        uses: github/codeql-action/init@e296a935590eb16afc0c0108289f68c87e2a89a5 # v4.30.7
+        uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        if: env.IS_NOT_MERGE_GROUP
-        uses: github/codeql-action/autobuild@e296a935590eb16afc0c0108289f68c87e2a89a5 # v4.30.7
+        uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
       - name: Perform CodeQL Analysis
-        if: env.IS_NOT_MERGE_GROUP
-        uses: github/codeql-action/analyze@e296a935590eb16afc0c0108289f68c87e2a89a5 # v4.30.7
+        uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/commit-message.yaml

@@ -8,10 +8,15 @@ on:
       - synchronize
       - edited
       - reopened
+
+permissions:
+  contents: read
+
 jobs:
   commit-message:
     if: ${{ github.event_name != 'merge_group' }}
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
       - name: verify_commit_message
         env:

.github/workflows/docs.yaml

@@ -3,8 +3,14 @@ name: Build and Deploy Retina.sh
 on:
   push:
     branches: ["main"]
+    paths:
+      - 'site/**'
+      - 'docs/**'
   pull_request:
     branches: ["main"]
+    paths:
+      - 'site/**'
+      - 'docs/**'
   workflow_dispatch:
   merge_group:
 permissions:
@@ -17,10 +23,11 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: 20
       - name: build
@@ -29,20 +36,21 @@ jobs:
           npm run build --prefix site/
       - name: Upload build artifact
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: "./site/build"
 
   deploy:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: build
     environment:
-      name: retina.sh 
+      name: retina.sh
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/e2e-test-event-writer.yml

@@ -20,6 +20,7 @@ jobs:
   retina-win-e2e-bpf-images:
     name: Build E2E Test Event Writer
     runs-on: windows-2022
+    timeout-minutes: 30
 
     env:
       IS_MERGE_GROUP: ${{ (github.event_name == 'merge_group') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/dev/v0.0.33-windows' && github.repository == 'microsoft/retina') }}
@@ -31,4 +32,4 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/e2e.yaml

@@ -83,6 +83,7 @@ jobs:
   e2e:
     name: E2E
     runs-on: ubuntu-latest
+    timeout-minutes: 120
 
     steps:
       - name: Checkout code
@@ -95,7 +96,7 @@ jobs:
       - run: go version
 
       - name: Az CLI login
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

.github/workflows/golangci-lint.yaml

@@ -6,6 +6,14 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   golangci:
     strategy:
@@ -15,22 +23,19 @@ jobs:
         goarch: ["amd64", "arm64"]
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
-      IS_NOT_MERGE_GROUP: ${{ github.event_name != 'merge_group' }}
       GOOS: ${{ matrix.goos }}
       GOARCH: ${{ matrix.goarch }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        if: env.IS_NOT_MERGE_GROUP
         with:
           fetch-depth: 0
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        if: env.IS_NOT_MERGE_GROUP
         with:
           go-version-file: go.mod
       - name: golangci-lint
-        if: env.IS_NOT_MERGE_GROUP
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           version: latest
           args: --concurrency 4 --verbose --config=.golangci.yaml --timeout=25m

.github/workflows/goreleaser.yaml

@@ -4,14 +4,21 @@ on:
     branches: [main]
   push:
     tags: ["v*"]
+
 permissions:
   contents: write
   packages: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: Build kubectl-retina
     if: github.ref_type == 'branch'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -22,7 +29,7 @@ jobs:
         with:
           go-version-file: go.mod
       - name: Run GoReleaser build
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         env:
           MCR_AGENT_IMAGE_NAME: mcr.microsoft.com/containernetworking/retina-agent
         with:
@@ -32,6 +39,7 @@ jobs:
   release:
     name: Release kubectl-retina
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: github.ref_type == 'tag'
     steps:
       - name: Checkout
@@ -43,7 +51,7 @@ jobs:
         with:
           go-version-file: go.mod
       - name: Run GoReleaser release
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           distribution: goreleaser
           version: latest
@@ -53,4 +61,4 @@ jobs:
           MCR_AGENT_IMAGE_NAME: mcr.microsoft.com/containernetworking/retina-agent
       - name: Update new version in krew-index
         if: github.repository_owner == 'microsoft'
-        uses: rajatjindal/krew-release-bot@v0.0.47
+        uses: rajatjindal/krew-release-bot@3d9faef30a82761d610544f62afddca00993eef9 # v0.0.47