NO-ISSUE: Remove unnecessary GH workflows and fix sec advisories (#217)

Signed-off-by: Ricardo Zanini <[email protected]>

Author: ricardozanini

.github/labeler.yml

@@ -12,5 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-source:
-  - '**/*'
+"documentation :notebook:":
+  - changed-files:
+      - any-glob-to-any-file: ['contrib/*', '**/*.md']
+kubernetes:
+  - changed-files:
+      - any-glob-to-any-file: ['kubernetes/*', 'hack/builder-gen.sh', 'hack/deepcopy-gen.sh', 'Makefile']

.github/labels.yml

@@ -22,6 +22,10 @@ on:
       - "Makefile"
     branches:
       - main
+
+permissions:
+  contents: read
+
 env:
   GO_VERSION: 1.22
 jobs:

.github/workflows/Go-SDK-Check-k8s-integration.yaml

@@ -22,6 +22,10 @@ on:
       - "Makefile"
     branches:
       - main
+
+permissions:
+  contents: read
+
 env:
   GO_VERSION: 1.22
 jobs:
@@ -67,7 +71,7 @@ jobs:
           changed_files=$(git status -s | grep -v 'go.mod\|go.sum\|tools.mod\|tools.sum' || :)
           [[ -z "$changed_files" ]] ||  (printf "Some files are not formatted properly: \n$changed_files\n Did you run 'make test' before sending the PR?" && exit 1)
       - name: Check lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1 - Please ALWAYS use SHA to avoid GH sec issues
         with:
           version: latest
       - name: Install cover

.github/workflows/Go-SDK-PR-Check.yaml

@@ -14,15 +14,13 @@
 
 name: "Pull Request Labeler"
 on:
-- pull_request_target
+  - pull_request_target
 
 jobs:
-  triage:
+  labeler:
     permissions:
       contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/[email protected]
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+      - uses: actions/labeler@v5

.github/workflows/prow_commands.yml

@@ -16,7 +16,9 @@ name: Mark stale issues and pull requests
 on:
   schedule:
     - cron: "0 0 * * *"
-
+permissions:
+  issues: write
+  pull-requests: write
 jobs:
   stale:
     runs-on: ubuntu-latest