OKDP · rpignolet · Jun 19, 2026 · Jun 12, 2026 · Jun 12, 2026 · Jun 19, 2026
diff --git a/.github/actions/free-disk-space/action.yml b/.github/actions/free-disk-space/action.yml
@@ -21,7 +21,7 @@ runs:
   using: composite
   steps:
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
       with:
         # this might remove tools that are actually needed,
         # if set to "true" but frees about 6 GB
@@ -36,5 +36,3 @@ runs:
         docker-images: true
         swap-storage: true
 
-
-
diff --git a/.github/actions/git-branch/action.yml b/.github/actions/git-branch/action.yml
@@ -38,16 +38,23 @@ runs:
   steps:
     - name: Get branch name
       id: git-branch
+      env:
+        EVENT_NAME: ${{ inputs.event_name }}
+        HEAD_REF: ${{ inputs.head_ref }}
+        REF: ${{ inputs.ref }}
       run: |
-        if [[ "${{ inputs.event_name }}" == "push" ]]; then
-          BRANCH_NAME="${GITHUB_REF##*/}"
-        elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-          BRANCH_NAME="${GITHUB_REF##*/}"
-        elif [[ "${{ inputs.event_name }}" == "pull_request" ]]; then
-          BRANCH_NAME="${{ inputs.head_ref }}"
+        if [[ "$EVENT_NAME" == "push" ]]; then
+          BRANCH_NAME="${REF#refs/heads/}"
+        elif [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
+          BRANCH_NAME="${REF#refs/heads/}"
+        elif [[ "$EVENT_NAME" == "pull_request" ]]; then
+          BRANCH_NAME="$HEAD_REF"
+        else
+          echo "Unsupported event: $EVENT_NAME" >&2
+          exit 1
         fi
         # Convert branch name to lowercase and replace '/' with '-'
         BRANCH_NAME=$(echo "$BRANCH_NAME" | tr '[:upper:]' '[:lower:]' | tr '/' '-')
         echo "Branch name: $BRANCH_NAME"
-        echo "branch=${BRANCH_NAME}" >> $GITHUB_OUTPUT
+        echo "branch=${BRANCH_NAME}" >> "$GITHUB_OUTPUT"
       shell: bash
diff --git a/.github/actions/helm-docs/action.yml b/.github/actions/helm-docs/action.yml
@@ -31,12 +31,18 @@ runs:
   steps:
 
     - name: Install helm-docs
+      env:
+        HELM_DOCS_VERSION: ${{ inputs.helm_docs_version }}
       run: |
-        wget https://github.com/norwoodj/helm-docs/releases/download/v${{ inputs.helm_docs_version }}/helm-docs_${{ inputs.helm_docs_version }}_Linux_x86_64.deb
-        sudo apt install ./helm-docs_${{ inputs.helm_docs_version }}_Linux_x86_64.deb
-        rm -f helm-docs_${{ inputs.helm_docs_version }}_Linux_x86_64.deb
-      shell: bash
-
-
+        if [[ ! "$HELM_DOCS_VERSION" =~ ^[0-9]+(\.[0-9]+){2}$ ]]; then
+          echo "Invalid helm-docs version: $HELM_DOCS_VERSION" >&2
+          exit 1
+        fi
 
+        package="helm-docs_${HELM_DOCS_VERSION}_Linux_x86_64.deb"
+        url="https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/${package}"
 
+        curl -fsSLO "$url"
+        sudo apt install "./$package"
+        rm -f "$package"
+      shell: bash
diff --git a/.github/actions/latest-image-tag/action.yml b/.github/actions/latest-image-tag/action.yml
@@ -36,20 +36,28 @@ runs:
       id: git-release-tag
       run: |
         LATEST_GIT_TAG=$(gh release ls -L 200 --json tagName --jq '.[].tagName|select(all(.; contains("helm") | not))' | head -1)
-        LATEST_TAG=$(echo $LATEST_GIT_TAG | tr -d 'v')
-        echo "latest_git_tag=${LATEST_GIT_TAG}" >> $GITHUB_OUTPUT
-        echo "latest_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
-        echo "image=${GITHUB_REPOSITORY#*/}" >> $GITHUB_OUTPUT
+        if [[ -z "$LATEST_GIT_TAG" ]]; then
+          echo "No non-helm GitHub release tag found" >&2
+          exit 1
+        fi
+
+        LATEST_TAG=$(echo "$LATEST_GIT_TAG" | tr -d 'v')
+        echo "latest_git_tag=${LATEST_GIT_TAG}" >> "$GITHUB_OUTPUT"
+        echo "latest_tag=${LATEST_TAG}" >> "$GITHUB_OUTPUT"
+        echo "image=${GITHUB_REPOSITORY#*/}" >> "$GITHUB_OUTPUT"
       env:
         GH_TOKEN: ${{ github.token }}
       shell: bash
 
     - name: Info - Found latest release tag
+      env:
+        IMAGE: ${{ steps.git-release-tag.outputs.image }}
+        LATEST_GIT_TAG: ${{ steps.git-release-tag.outputs.latest_git_tag }}
+        LATEST_TAG: ${{ steps.git-release-tag.outputs.latest_tag }}
       run: |
-          echo "image: ${{ steps.git-release-tag.outputs.image }}"
-          echo "latest_tag: ${{ steps.git-release-tag.outputs.latest_tag }}"
-          echo "latest_git_tag: ${{ steps.git-release-tag.outputs.latest_git_tag }}"
+          echo "image: $IMAGE"
+          echo "latest_tag: $LATEST_TAG"
+          echo "latest_git_tag: $LATEST_GIT_TAG"
       shell: bash
 
 
-
diff --git a/.github/actions/makefile-run/action.yml b/.github/actions/makefile-run/action.yml
@@ -28,7 +28,15 @@ runs:
   steps:
 
     - name: Run tests if enabled
-      run: ${{ inputs.command }}
-      shell: bash
+      env:
+        MAKE_COMMAND: ${{ inputs.command }}
+      run: |
+        if [[ ! "$MAKE_COMMAND" =~ ^make([[:space:]][A-Za-z0-9_./:=+-]+)*$ ]]; then
+          echo "Unsupported make command: $MAKE_COMMAND" >&2
+          exit 1
+        fi
 
+        read -r -a command <<< "$MAKE_COMMAND"
+        "${command[@]}"
+      shell: bash
 
diff --git a/.github/actions/setup-buildx/action.yaml b/.github/actions/setup-buildx/action.yaml
@@ -21,9 +21,9 @@ runs:
   using: composite
   steps:
     - name: Set up QEMU 📦
-      uses: docker/setup-qemu-action@v4
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
     - name: Set up Docker Buildx 📦
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       with:
-        driver-opts: network=host
+        driver-opts: network=host
diff --git a/.github/actions/setup-kind/action.yaml b/.github/actions/setup-kind/action.yaml
@@ -21,7 +21,7 @@ runs:
   using: composite
   steps:
     - name: Create k8s Kind Cluster
-      uses: helm/kind-action@v1
+      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
       with:
         # https://github.com/helm/kind-action?tab=readme-ov-file#inputs
         verbosity: 10
@@ -34,4 +34,4 @@ runs:
         kubectl cluster-info
         kubectl get pods -A
         kubectl describe node
-      shell: bash
+      shell: bash
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,36 @@
+#
+# Copyright 2026 The OKDP Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:07"
+      timezone: Europe/Paris
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: chore
+      include: scope
+    labels:
+      - dependencies
+      - github-actions
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/docker-build-test-push-template.yml b/.github/workflows/docker-build-test-push-template.yml
@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout Repo ⚡️
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Free up disk space 📦
         uses: okdp/gh-workflows/.github/actions/free-disk-space@v1
@@ -54,9 +54,13 @@ jobs:
 
       - name: Set up container registry 📦
         id: ci_registry
+        env:
+          INPUT_CI_REGISTRY: ${{ inputs.ci_registry }}
+          VAR_CI_REGISTRY: ${{ vars.CI_REGISTRY }}
         run:  |
-          echo "ci_registry=${{ vars.CI_REGISTRY || inputs.ci_registry }}" >> "$GITHUB_OUTPUT"
-          echo "registry_repo=${{ vars.CI_REGISTRY || inputs.ci_registry }}/${GITHUB_REPOSITORY_OWNER@L}" >> "$GITHUB_OUTPUT"
+          ci_registry="${VAR_CI_REGISTRY:-$INPUT_CI_REGISTRY}"
+          echo "ci_registry=$ci_registry" >> "$GITHUB_OUTPUT"
+          echo "registry_repo=${ci_registry}/${GITHUB_REPOSITORY_OWNER@L}" >> "$GITHUB_OUTPUT"
           echo "image=${GITHUB_REPOSITORY#*/}" >> "$GITHUB_OUTPUT"
 
       - name: Evaluate CI push policy 🔎
@@ -84,24 +88,27 @@ jobs:
 
       - name: Set CI image tag
         id: image-tag
+        env:
+          BRANCH: ${{ steps.get-branch.outputs.branch }}
+          IMAGE: ${{ steps.ci_registry.outputs.image }}
+          REGISTRY_REPO: ${{ steps.ci_registry.outputs.registry_repo }}
         run: |
-          branch="${{ steps.get-branch.outputs.branch }}"
-          tag_branch="$(echo "$branch" | sed 's#/#--#g')"
-          ci_tag="${{ steps.ci_registry.outputs.registry_repo }}/${{ steps.ci_registry.outputs.image }}:${tag_branch}"
+          tag_branch="$(echo "$BRANCH" | sed 's#/#--#g')"
+          ci_tag="${REGISTRY_REPO}/${IMAGE}:${tag_branch}"
 
           echo "ci_tag=$ci_tag" >> "$GITHUB_OUTPUT"
           echo "Set image tag to: $ci_tag"
 
       - name: Login into ${{ steps.ci_registry.outputs.ci_registry }} registry 🔐
         if: steps.push-policy.outputs.can_push_ci == 'true'
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ steps.ci_registry.outputs.ci_registry }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push image ${{ steps.image-tag.outputs.ci_tag }} 📤
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ${{ inputs.path }}Dockerfile

diff --git a/.github/workflows/docker-publish-template.yml b/.github/workflows/docker-publish-template.yml
@@ -29,6 +29,14 @@ on:
         required: false
         type: string
         default: 'quay.io'
+    secrets:
+      REGISTRY_USERNAME:
+        required: true
+      REGISTRY_ROBOT_TOKEN:
+        required: true
+
+permissions:
+  contents: read
 
 defaults:
   run:
@@ -44,7 +52,7 @@ jobs:
       latest_git_tag: ${{ steps.latest-image-tag.outputs.latest_git_tag }}
     steps:
       - name: Checkout Repo ⚡️
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Get latest GitHub Release tag name 📥
         id: latest-image-tag
@@ -56,7 +64,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: Checkout release tag ${{ needs.latest-image-tag.outputs.latest_git_tag }} ⚡️
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           ref: ${{ needs.latest-image-tag.outputs.latest_git_tag }}
@@ -70,35 +78,43 @@ jobs:
 
       - name: Set up container registry 📦
         id: registry
+        env:
+          INPUT_REGISTRY: ${{ inputs.registry }}
+          VAR_REGISTRY: ${{ vars.REGISTRY }}
         run:  |
-            echo "registry=${{ vars.REGISTRY || inputs.registry }}" >> $GITHUB_OUTPUT
-            echo "registry_repo=${{ vars.REGISTRY || inputs.registry }}/${GITHUB_REPOSITORY_OWNER@L}" >> $GITHUB_OUTPUT
+            registry="${VAR_REGISTRY:-$INPUT_REGISTRY}"
+            echo "registry=$registry" >> "$GITHUB_OUTPUT"
+            echo "registry_repo=${registry}/${GITHUB_REPOSITORY_OWNER@L}" >> "$GITHUB_OUTPUT"
 
       ### Publish steps
       ### The publish and periodic rebuilds are based on the latest stable github release tag
       - name: Login into ${{ steps.registry.outputs.registry }} registry 🔐
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ steps.registry.outputs.registry }}
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_ROBOT_TOKEN }}
 
       - name: Set image tags
         id: image-tags
+        env:
+          IMAGE: ${{ needs.latest-image-tag.outputs.image }}
+          LATEST_TAG: ${{ needs.latest-image-tag.outputs.latest_tag }}
+          REGISTRY_REPO: ${{ steps.registry.outputs.registry_repo }}
         run: |
-           IMAGE_TAG=$(echo "${{ needs.latest-image-tag.outputs.latest_tag }}" | awk -F- '{ print $1 }')
-           if [ "$IMAGE_TAG" != "${{ needs.latest-image-tag.outputs.latest_tag }}" ]
+           image_tag="$(echo "$LATEST_TAG" | awk -F- '{ print $1 }')"
+           if [ "$image_tag" != "$LATEST_TAG" ]
            then
-             IMAGE_TAGS="${{ steps.registry.outputs.registry_repo }}/${{ needs.latest-image-tag.outputs.image }}:${IMAGE_TAG},"
+             image_tags="${REGISTRY_REPO}/${IMAGE}:${image_tag},"
            fi
 
-           IMAGE_TAGS+="${{ steps.registry.outputs.registry_repo }}/${{ needs.latest-image-tag.outputs.image }}:${{ needs.latest-image-tag.outputs.latest_tag }}"
+           image_tags+="${REGISTRY_REPO}/${IMAGE}:${LATEST_TAG}"
 
-           echo "tags=${IMAGE_TAGS}" >> $GITHUB_OUTPUT
-           echo "Set image tags to: $IMAGE_TAGS"
+           echo "tags=${image_tags}" >> "$GITHUB_OUTPUT"
+           echo "Set image tags to: $image_tags"
 
       - name: Build and push to ${{ steps.registry.outputs.registry_repo }} repository 📤
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ${{ inputs.path }}/Dockerfile
@@ -111,4 +127,3 @@ jobs:
             org.opencontainers.image.description="${{ needs.latest-image-tag.outputs.image }} image"
             org.opencontainers.image.source="https://github.com/${{ github.repository }}"
             org.opencontainers.image.licenses="Apache-2.0"
-
diff --git a/.github/workflows/helm-docker-release-please-template.yml b/.github/workflows/helm-docker-release-please-template.yml
@@ -39,26 +39,40 @@ on:
         description: Github released tag name
         required: true
         type: string
+    secrets:
+      REGISTRY_USERNAME:
+        required: true
+      REGISTRY_ROBOT_TOKEN:
+        required: true
+
+permissions:
+  contents: read
 
 jobs:
 
   helm-chart-publish:
     if: inputs.package_type == 'helm'
     name: "Helm publish (${{ inputs.package }}-${{ inputs.version }})"
+    permissions:
+      contents: write
     uses: okdp/gh-workflows/.github/workflows/helm-publish-template.yml@v1
     with:
         path: ${{ inputs.path }}
         chart_name: ${{ inputs.package }}
         version: ${{ inputs.version }}
         git_tag_name: ${{ inputs.git_tag_name }}
-    secrets: inherit
+    secrets:
+      REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+      REGISTRY_ROBOT_TOKEN: ${{ secrets.REGISTRY_ROBOT_TOKEN }}
 
   docker-publish:
     if: inputs.package_type == 'docker'
     name: "Docker publish (${{ inputs.package }}-${{ inputs.version }})"
+    permissions:
+      contents: read
     uses: okdp/gh-workflows/.github/workflows/docker-publish-template.yml@v1
     with:
       path: ${{ inputs.path }}
-    secrets: inherit
-
-
+    secrets:
+      REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+      REGISTRY_ROBOT_TOKEN: ${{ secrets.REGISTRY_ROBOT_TOKEN }}