Merge branch 'main' of github.com:mindersec/minder into feat/organization-entity-5377

Author: Jaydeep869

.github/workflows/boilerplates.yaml

@@ -43,7 +43,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: chainguard-dev/actions/boilerplate@f45211d3e8f9d2676c6b8cdd6a765435e06c819d # v1.6.13
+      - uses: chainguard-dev/actions/boilerplate@061bc0e921116bde1470f51fb5c86d5318f16558 # v1.6.15
         with:
           extension: ${{ matrix.extension }}
           language: ${{ matrix.language }}

.github/workflows/deploy-doc.yml

@@ -18,7 +18,7 @@ jobs:
         working-directory: docs
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
       - name: Install dependencies

.github/workflows/main.yml

@@ -11,7 +11,6 @@ on:
       - 'docs/**'
 permissions:
   contents: read
-  packages: write
 
 jobs:
   license-check:
@@ -26,10 +25,16 @@ jobs:
       checks: write
     uses: ./.github/workflows/lint.yml
   build:
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/build.yml
   test:
     uses: ./.github/workflows/test.yml
   image-build:
     uses: ./.github/workflows/image-build.yml
   security:
+    permissions:
+      contents: read
+      security-events: write
     uses: ./.github/workflows/security.yml

.github/workflows/pr.yml

@@ -28,6 +28,9 @@ jobs:
   image-build:
     uses: ./.github/workflows/image-build.yml
   security:
+    permissions:
+      contents: read
+      security-events: write
     uses: ./.github/workflows/security.yml
   compose-migrate:
     uses: ./.github/workflows/compose-migrate.yml

.github/workflows/releaser.yml

@@ -60,7 +60,7 @@ jobs:
         uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
       - name: Run GoReleaser
         id: run-goreleaser
-        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
+        uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
         with:
           distribution: goreleaser
           version: "~> v2"

.github/workflows/scorecard.yml

@@ -29,7 +29,7 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/security.yml

@@ -3,10 +3,16 @@
 
 on:
   workflow_call:
+
 jobs:
   security-scan:
     runs-on: ubuntu-latest
     name: Security Scan
+
+    permissions:
+      contents: read
+      security-events: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -15,7 +21,7 @@ jobs:
         run: mkdir -p ../results
 
       - name: Code Security Scan
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: 'fs'
           scanners: vuln,secret
@@ -32,12 +38,13 @@ jobs:
 
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v4
+        if: always()
         with:
           sarif_file: code-results.sarif
           category: code-scan
 
       - name: Helm Security Scan
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
         if: always()
         with:
           skip-setup-trivy: true
@@ -55,6 +62,7 @@ jobs:
 
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v4
+        if: always()
         with:
           sarif_file: helm-results.sarif
           category: infra-scan

.github/workflows/test-deploy-doc.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
       - name: Install dependencies

.github/workflows/test.yml

@@ -26,7 +26,7 @@ jobs:
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
       # Install gotestfmt and go-junit-report on the VM running the action.
       - name: Set up gotestfmt
-        uses: GoTestTools/gotestfmt-action@8b4478c7019be847373babde9300210e7de34bfb # v2.2.0
+        uses: GoTestTools/gotestfmt-action@eba2ac97f623e866e7b1b117c99f18b43cd36d18 # v2.3.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Install gotestsum
@@ -58,7 +58,7 @@ jobs:
           gotestsum  --junitfile test-results.xml --junitfile-hide-empty-pkg --raw-command -- cat test-results.json
       - name: Upload test results
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: test-results
           path: test-results.*

.github/workflows/update-docs-cli.yml

@@ -34,7 +34,7 @@ jobs:
           echo "commit_date=$COMMIT_DATE" >> $GITHUB_OUTPUT
           echo "commit_author=$COMMIT_AUTHOR" >> $GITHUB_OUTPUT
       - name: Commit and push changes
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           commit-message: Update documentation
           committer: GitHub <noreply@github.com>