ci: Fix zizmor warnings and bump actions

.github/workflows/dev_dbt.yaml

@@ -1,5 +1,6 @@
 ---
 name: Build and publish dbt-demo
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -12,11 +13,15 @@ on:
       - demos/airflow-scheduled-job/dbt/Dockerfile
       - demos/airflow-scheduled-job/dbt/requirements.txt
       - .github/workflows/dev_dbt.yaml
+      - .github/workflows/reusable_build_image.yaml
 
 jobs:
   build_image:
     name: Reusable Workflow
     uses: ./.github/workflows/reusable_build_image.yaml
+    permissions:
+      contents: read
+      id-token: write # Needed for cosign keyless signing in the reusable workflow
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}

.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml

@@ -1,5 +1,6 @@
 ---
 name: Build and publish jupyter-pyspark-with-alibi-detect
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -12,11 +13,15 @@ on:
       - demos/signal-processing/Dockerfile-jupyter
       - demos/signal-processing/requirements.txt
       - .github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml
+      - .github/workflows/reusable_build_image.yaml
 
 jobs:
   build_image:
     name: Reusable Workflow
     uses: ./.github/workflows/reusable_build_image.yaml
+    permissions:
+      contents: read
+      id-token: write # Needed for cosign keyless signing in the reusable workflow
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}

.github/workflows/dev_jupyterhub-keycloak-spark.yaml

@@ -1,5 +1,6 @@
 ---
 name: Build and publish Spark for jupyterhub-keycloak demo
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -13,11 +14,15 @@ on:
     paths:
       - demos/jupyterhub-keycloak/Dockerfile
       - .github/workflows/dev_jupyterhub-keycloak-spark.yaml
+      - .github/workflows/reusable_build_image.yaml
 
 jobs:
   build_image:
     name: Reusable Workflow
     uses: ./.github/workflows/reusable_build_image.yaml
+    permissions:
+      contents: read
+      id-token: write # Needed for cosign keyless signing in the reusable workflow
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}

.github/workflows/dev_nifi.yaml

@@ -1,5 +1,6 @@
 ---
 name: Build and publish NiFi for signal-processing demo
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -13,11 +14,15 @@ on:
     paths:
       - demos/signal-processing/Dockerfile-nifi
       - .github/workflows/dev_nifi.yaml
+      - .github/workflows/reusable_build_image.yaml
 
 jobs:
   build_image:
     name: Reusable Workflow
     uses: ./.github/workflows/reusable_build_image.yaml
+    permissions:
+      contents: read
+      id-token: write # Needed for cosign keyless signing in the reusable workflow
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}

.github/workflows/pr_prek.yml

@@ -0,0 +1,19 @@
+---
+name: prek
+permissions: {}
+
+on:
+  pull_request:
+  merge_group:
+
+jobs:
+  prek:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: stackabletech/actions/run-prek@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0

.github/workflows/reusable_build_image.yaml

@@ -19,20 +19,23 @@ on:
         description: The Slack token used to post failure notifications
         required: true
 
+permissions: {}
+
 jobs:
   build:
     name: Build/Publish ${{ inputs.image-version }}-${{ matrix.runner.arch }} Image
     permissions:
-      id-token: write
+      contents: read
+      id-token: write # Needed for cosign keyless signing in publish-image
     runs-on: ${{ matrix.runner.name }}
     strategy:
       matrix:
         runner:
-          - {name: "ubuntu-latest", arch: "amd64"}
-          - {name: "ubicloud-standard-8-arm", arch: "arm64"}
+          - { name: "ubuntu-latest", arch: "amd64" }
+          - { name: "ubicloud-standard-8-arm", arch: "arm64" }
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -42,7 +45,7 @@ jobs:
           CONTAINERFILE_PATH: ${{ inputs.containerfile-path }}
           IMAGE_VERSION: ${{ inputs.image-version }}
           IMAGE_NAME: ${{ inputs.image-name }}
-        uses: stackabletech/actions/build-container-image@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0
+        uses: stackabletech/actions/build-container-image@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-index-manifest-tag: ${{ env.IMAGE_VERSION }}
@@ -51,76 +54,51 @@ jobs:
       - name: Publish Container Image on oci.stackable.tech
         env:
           IMAGE_NAME: ${{ inputs.image-name }}
-        uses: stackabletech/actions/publish-image@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0
+        uses: stackabletech/actions/publish-image@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$demos+github-action-build
           image-registry-password: ${{ secrets.harbor-robot-secret }}
           image-repository: demos/${{ env.IMAGE_NAME }}
           image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
-          source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}
+          canonical-image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
+          canonical-source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}
 
   publish_manifests:
     name: Build/Publish Manifest
     needs: [build]
     permissions:
-      id-token: write
+      contents: read
+      id-token: write # Needed for cosign keyless signing in publish-image-index-manifest
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Publish and Sign Image Index Manifest to oci.stackable.tech
         env:
           IMAGE_VERSION: ${{ inputs.image-version }}
           IMAGE_NAME: ${{ inputs.image-name }}
-        uses: stackabletech/actions/publish-index-manifest@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0
+        uses: stackabletech/actions/publish-image-index-manifest@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$demos+github-action-build
           image-registry-password: ${{ secrets.harbor-robot-secret }}
           image-repository: demos/${{ env.IMAGE_NAME }}
-          image-index-manifest-tag: ${{ env.IMAGE_VERSION }}
+          canonical-image-index-manifest-tag: ${{ env.IMAGE_VERSION }}
 
   notify:
     name: Failure Notification
     needs: [build, publish_manifests]
     runs-on: ubuntu-latest
-    if: failure()
+    if: failure() || (github.run_attempt > 1 && !cancelled())
     steps:
-      - uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0
+      - uses: stackabletech/actions/send-slack-notification@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
         with:
+          publish-manifests-result: ${{ needs.publish_manifests.result }}
+          build-result: ${{ needs.build.result }}
+          slack-token: ${{ secrets.slack-token }}
+          type: container-image-build
           channel-id: "C07UG6JH44F" # notifications-container-images
-          payload: |
-            {
-              "text": "*${{ github.workflow }}* failed (attempt ${{ github.run_attempt }})",
-              "attachments": [
-                {
-                  "pretext": "See the details below for a summary of which job(s) failed.",
-                  "color": "#aa0000",
-                  "fields": [
-                    {
-                      "title": "Build/Publish Image",
-                      "short": true,
-                      "value": "${{ needs.build.result }}"
-                    },
-                    {
-                      "title": "Build/Publish Manifests",
-                      "short": true,
-                      "value": "${{ needs.publish_manifests.result }}"
-                    }
-                  ],
-                  "actions": [
-                    {
-                      "type": "button",
-                      "text": "Go to workflow run",
-                      "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}"
-                    }
-                  ]
-                }
-              ]
-            }
-        env:
-          SLACK_BOT_TOKEN: ${{ secrets.slack-token }}