Fix gh actions and also add a local super-linter target

The super-linter takes too long so let's just keep it local for now

Author: mbaldessari

.github/workflows/docker-build.yml

@@ -1,13 +1,18 @@
 name: "Docker Build"
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   docker-build:
     name: Docker Build
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Docker Build
         env:

.github/workflows/go.yml

@@ -2,20 +2,25 @@ name: Go
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
 
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
-    - name: Set up Go
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: go.mod
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
 
-    - name: Build
-      run: make build
+      - name: Build
+        run: make build
 
-    - name: Test
-      run: make test
+      - name: Test
+        run: make test

.github/workflows/lint.yaml

@@ -1,13 +1,18 @@
 name: Integration tests
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   lint_code:
     name: Run golangci-lint on PR
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Setup go
         uses: actions/setup-go@v5
@@ -22,7 +27,7 @@ jobs:
           echo '' > "${APIFILE}"
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
           version: v2.2.2
           args: --timeout 5m -v

.github/workflows/push-built-tag.yml

@@ -5,21 +5,29 @@ on:
     tags:
       - '[0-9]+.[0-9]+.[0-9]+'
 
+permissions:
+  contents: read
+
 jobs:
   build_and_push_image:
     name: Build and push pattern-operator image to quay.io
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
+      # We use an env due to https://docs.zizmor.sh/audits/#remediation_18
       - name: Check that tag version corresponds to metadata version
         run: |-
           VERSION=$(yq -r '.spec.version' bundle/manifests/patterns-operator.clusterserviceversion.yaml)
-          TAG=${{ github.ref_name }}
+          TAG="${ TAG_ENV }"
           if [ "${VERSION}" != "${TAG}" ]; then
             echo "Version in metadata ${VERSION} whereas tag is different: ${TAG}"
             exit 1
           fi
+        env:
+          TAG_ENV: ${{ github.ref_name }}
 
       - name: Check that both QUAY_ROBOT_USER and QUAY_ROBOT_TOKEN exist
         run: |-

Makefile

@@ -333,3 +333,23 @@ catalog-install: config/samples/pattern-catalog-$(VERSION).yaml ## Install the O
 config/samples/pattern-catalog-$(VERSION).yaml:
 	cp  config/samples/pattern-catalog.yaml config/samples/pattern-catalog-$(VERSION).yaml
 	sed -i -e "s@CATALOG_IMG@$(CATALOG_IMG)@g" config/samples/pattern-catalog-$(VERSION).yaml
+
+.PHONY: super-linter
+super-linter: ## Runs super linter locally
+	rm -rf .mypy_cache
+	podman run -e RUN_LOCAL=true -e USE_FIND_ALGORITHM=true	\
+					-e VALIDATE_ANSIBLE=false \
+					-e VALIDATE_BASH=false \
+					-e VALIDATE_CHECKOV=false \
+					-e VALIDATE_DOCKERFILE_HADOLINT=false \
+					-e VALIDATE_JSCPD=false \
+					-e VALIDATE_JSON_PRETTIER=false \
+					-e VALIDATE_MARKDOWN_PRETTIER=false \
+					-e VALIDATE_PYTHON_PYLINT=false \
+					-e VALIDATE_SHELL_SHFMT=false \
+					-e VALIDATE_YAML=false \
+					-e VALIDATE_YAML_PRETTIER=false \
+					$(DISABLE_LINTERS) \
+					-v $(PWD):/tmp/lint:rw,z \
+					-w /tmp/lint \
+					ghcr.io/super-linter/super-linter@sha256:6c71bd17ab38ceb7acb5b93ef72f5c2288b5456a5c82693ded3ee8bb501bba7f # slim-v8.1.0