fix(actions): remove outdated actions and update documentation accordingly

.github/scripts/coverage/get-coverage.py

@@ -146,8 +146,9 @@ def main():
             color = 'orange'
         else:
             color = 'red'
-        print(f"::set-output name=coverage::{total}")
-        print(f"::set-output name=color::{color}")
+        with open(os.environ['GITHUB_OUTPUT'], 'a') as fd:
+            fd.write(f"coverage={total}\n")
+            fd.write(f"color={color}\n")
     print(f"Total coverage: {total}")
 
 

.github/scripts/metrics/get_metrics.py

@@ -92,14 +92,16 @@ def queries_count(path):
         'Platform', 'Count'], tablefmt='orgtbl'))
     print("::endgroup::")
     print()
-    print(f"::set-output name=total_queries::{summary['total']}")
+    with open(os.environ['GITHUB_OUTPUT'], 'a') as fd:
+        fd.write(f"total_queries={summary['total']}\n")
     print()
     print("::group::Rego File Metrics")
     print(tabulate([[key, value] for key, value in rego_summary.items()], headers=[
         'Platform', 'Count'], tablefmt='orgtbl'))
     print("::endgroup::")
     print()
-    print(f"::set-output name=total_rego_files::{rego_summary['total']}")
+    with open(os.environ['GITHUB_OUTPUT'], 'a') as fd:
+        fd.write(f"total_rego_files={rego_summary['total']}\n")
     print()
     print("::group::Sample File Metrics")
     print(tabulate([[key, value] for key, value in samples_summary.items()], headers=[

.github/workflows/alert-update-flags.yaml

@@ -29,12 +29,14 @@ jobs:
           AWS_REGION: ${{ secrets.EMAIL_AWS_REGION }}
           AWS_ACCESS_KEY_ID: ${{ secrets.EMAIL_AWS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.EMAIL_AWS_SECRET_KEY }}
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
         run: |
           for item in internal/console/assets/*-flags.json; do cat $item > $item-curr; done;
           git checkout HEAD~1
           for item in internal/console/assets/*-flags.json; do cat $item > $item-old; done;
           printf -v curr "'%s'," internal/console/assets/*-flags.json-curr
           printf -v old "'%s'," internal/console/assets/*-flags.json-old
+          pip config set global.index-url "https://:${ECHO_LIBRARIES_ACCESS_KEY}@pypi.echohq.com/simple"
           pip3 install -r .github/scripts/watchers/requirements.txt
           python3 -u .github/scripts/watchers/change-flags-email.py \
             -n $(echo "${curr%,}") -o $(echo "${old%,}")

.github/workflows/alert-update-terraform-modules.yaml

@@ -16,6 +16,9 @@ jobs:
   notification-update-flags:
     name: Send email with terraform modules updates
     runs-on: cx-public-ubuntu-x64
+    permissions:
+      contents: write # for create-pull-request to push a branch
+      pull-requests: write # for create-pull-request to open the PR
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -27,7 +30,9 @@ jobs:
           AWS_REGION: ${{ secrets.EMAIL_AWS_REGION }}
           AWS_ACCESS_KEY_ID: ${{ secrets.EMAIL_AWS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.EMAIL_AWS_SECRET_KEY }}
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
         run: |
+          pip config set global.index-url "https://:${ECHO_LIBRARIES_ACCESS_KEY}@pypi.echohq.com/simple"
           pip3 install -r .github/scripts/watchers/requirements.txt
           python3 -u .github/scripts/watchers/terraform-modules-update.py \
             -c assets/libraries/common.json \
@@ -38,7 +43,7 @@ jobs:
           GIT_SHA: ${{ github.sha }}
         with:
           title: "feat(queries): update terraform registry data on commons.json"
-          token: ${{ secrets.KICS_BOT_PAT }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "feat(queries): update terraform registry data on commons.json"
           delete-branch: true
           branch: feature/kicsbot-update-queries-docs

.github/workflows/check-apache-license.yaml

@@ -20,10 +20,13 @@ jobs:
     name: Check Apache License
     runs-on: cx-public-ubuntu-x64
     timeout-minutes: 1
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      pull-requests: write # to read/write comments on the PR via GITHUB_TOKEN
     env:
       BODY: ${{ github.event.pull_request.body }}
       USERNAME: ${{ github.event.pull_request.user.login }}
-      KICS_BOT_PAT: ${{ secrets.KICS_BOT_PAT }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       REPOSITORY: ${{ github.repository }}
       PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
@@ -40,7 +43,7 @@ jobs:
     - name: Check for comment tag
       if: env.CHECK_FAILED != 'true'
       run: |
-        comments=$(curl -s -H "Authorization: token "${KICS_BOT_PAT}"" \
+        comments=$(curl -s -H "Authorization: token "${GITHUB_TOKEN}"" \
             -X GET "https://api.github.com/repos/"${REPOSITORY}"/issues/"${PR_NUMBER}"/comments")
         if echo "$comments" | grep -q "apache_license"; then
           echo "TAG_EXISTS=true" >> $GITHUB_ENV
@@ -55,7 +58,7 @@ jobs:
           Deleting comment...
         comment-tag: apache_license
         mode: delete
-        github-token: "${KICS_BOT_PAT}"
+        github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Add comment if no license
       if: env.CHECK_FAILED == 'true'
       uses: step-security/actions-comment-pull-request@60cd38988a354b2d22b47612fb02a20e822d6048 # v3.0.2
@@ -64,7 +67,7 @@ jobs:
         comment-tag: apache_license
         mode: recreate
         create-if-not-exists: true
-        github-token: "${KICS_BOT_PAT}"
+        github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Workflow failed
       if: env.CHECK_FAILED == 'true'
       run: exit 1

.github/workflows/check-go-coverage.yaml

@@ -34,7 +34,7 @@ jobs:
           make test-coverage-report | tee test-results
           TOTAL_TESTS=$(cat test-results | grep -v TestQueriesContent/ | grep -v TestQueriesMetadata/ | grep -v TestQueries/ | grep PASS | wc -l)
           echo "Total number of tests :: ${TOTAL_TESTS}"
-          echo "::set-output name=total_tests::${TOTAL_TESTS}"
+          echo "total_tests=${TOTAL_TESTS}" >> "$GITHUB_OUTPUT"
       - name: Checks if Go coverage is at least 74%
         env:
           GO_COVERAGE: ${{ steps.testcov.outputs.coverage }}

.github/workflows/go-ci-coverage.yaml

@@ -35,7 +35,7 @@ jobs:
           make test-coverage-report | tee test-results
           TOTAL_TESTS=$(cat test-results | grep -v TestQueriesContent/ | grep -v TestQueriesMetadata/ | grep -v TestQueries/ | grep PASS | wc -l)
           echo "Total Tests :: ${TOTAL_TESTS}"
-          echo "::set-output name=total_tests::${TOTAL_TESTS}"
+          echo "total_tests=${TOTAL_TESTS}" >> "$GITHUB_OUTPUT"
       - name: Generate badge
         env:
           GO_COVERAGE: ${{ steps.testcov.outputs.coverage }}

.github/workflows/go-ci-metrics.yaml

@@ -29,7 +29,10 @@ jobs:
           python-version: "3.x"
       - name: Run test metrics script
         id: metrics
+        env:
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
         run: |
+          pip config set global.index-url "https://:${ECHO_LIBRARIES_ACCESS_KEY}@pypi.echohq.com/simple"
           pip3 install -r .github/scripts/metrics/requirements.txt
           python3 .github/scripts/metrics/get_metrics.py
       - name: Generate badge

.github/workflows/go-generate-antlr-parser.yaml

@@ -18,6 +18,9 @@ jobs:
   metrics:
     name: generate-antlr-parser
     runs-on: cx-public-ubuntu-x64
+    permissions:
+      contents: write # for create-pull-request to push a branch
+      pull-requests: write # for create-pull-request to open the PR
     steps:
       - name: Checkout Source
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -39,7 +42,7 @@ jobs:
         uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1
         with:
           title: "chore(parser): updating AWS jsonfilter ANTLR generated parser"
-          token: ${{ secrets.KICS_BOT_PAT }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "chore(parser): updating AWS jsonfilter ANTLR generated parser"
           delete-branch: true
           branch: feature/kicsbot-update-jsonfilter-parser

.github/workflows/go-test-race.yml

@@ -32,8 +32,8 @@ jobs:
       - name: Get cache paths
         id: go-cache-paths
         run: |
-          echo "::set-output name=go-build::$(go env GOCACHE)"
-          echo "::set-output name=go-mod::$(go env GOMODCACHE)"
+          echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
+          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
       - name: Cache dependencies
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:

.github/workflows/mkdocs.yml

@@ -29,7 +29,7 @@ jobs:
       - uses: toko-bifrost/ms-teams-deploy-card@dcc94e4ce4088b1e6b6de5c9a3cda4ddcbe97d2e # 3.1.2
         if: always()
         with:
-          github-token: ${{ secrets.KICS_BOT_PAT }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           webhook-uri: ${{ secrets.MSTEAMS_WEBHOOK_URL }}
           card-layout-start: cozy
           card-layout-exit: complete
@@ -44,7 +44,10 @@ jobs:
         with:
           python-version: 3.x
       - name: Install dependencies
+        env:
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
         run: |
+          pip config set global.index-url "https://:${ECHO_LIBRARIES_ACCESS_KEY}@pypi.echohq.com/simple"
           pip install mkdocs-bootswatch mike mkdocs-material
       - run: |
           git config --global user.name "KICSBot"

.github/workflows/prepare-release.yaml

@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
       - name: Get current date
         id: cdate
-        run: echo "::set-output name=date::$(date +'%Y.%m.%d')"
+        run: echo "date=$(date +'%Y.%m.%d')" >> "$GITHUB_OUTPUT"
       - name: Print variables
         env:
           CURRENT_DATE: ${{ steps.cdate.outputs.date }}

.github/workflows/release-commits.yaml

@@ -31,6 +31,9 @@ jobs:
           python-version: "3.x"
       - name: Run get release commits script
         id: commits
+        env:
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
         run: |
+          pip config set global.index-url "https://:${ECHO_LIBRARIES_ACCESS_KEY}@pypi.echohq.com/simple"
           pip3 install -r .github/scripts/release-commits/requirements.txt
           python3 .github/scripts/release-commits/get_commits.py

.github/workflows/release-dkr-image.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Get Release version
         id: get-version
         run: |
-          echo "::set-output name=version::$(git describe --match='v*' --tags --abbrev=0)"
+          echo "version=$(git describe --match='v*' --tags --abbrev=0)" >> "$GITHUB_OUTPUT"
       - uses: toko-bifrost/ms-teams-deploy-card@dcc94e4ce4088b1e6b6de5c9a3cda4ddcbe97d2e # 3.1.2
         if: always()
         with: