Merge pull request #5738 from hassaansaleem28/sync/o11y-main-oct

Sync feature/o11y with main

Author: arkid15r

.docksec-ignore.yml

@@ -0,0 +1,5 @@
+ignores:
+  - id: DS002
+    reason: >-
+      Scanner and tool images run as root. Trivy DS-0002 covers application
+      Dockerfiles that omit USER.

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+# actionlint 1.7.12 does not know the Ubuntu 26.04 runner labels yet
+# (rhysd/actionlint#683 is unreleased). Drop this file once a release includes them.
+self-hosted-runner:
+  labels:
+    - ubuntu-26.04
+    - ubuntu-26.04-arm

.github/actions/install-infrastructure-dependencies/action.yaml

@@ -23,6 +23,6 @@ runs:
           poetry-venv-${{ runner.os }}-${{ runner.arch }}-python-3.13-
 
     - name: Install infrastructure dependencies
-      run: poetry install --no-interaction --with test
+      run: poetry install --no-interaction --no-root --with test
       shell: bash
       working-directory: infrastructure

.github/dependabot.yml

@@ -19,7 +19,8 @@ updates:
         patterns:
           - '*'
     schedule:
-      interval: daily
+      day: thursday
+      interval: weekly
     target-branch: main
 
   - package-ecosystem: docker-compose
@@ -33,7 +34,8 @@ updates:
         patterns:
           - '*'
     schedule:
-      interval: daily
+      day: thursday
+      interval: weekly
     target-branch: main
 
   - package-ecosystem: github-actions
@@ -47,7 +49,8 @@ updates:
         patterns:
           - '*'
     schedule:
-      interval: daily
+      day: thursday
+      interval: weekly
     target-branch: main
 
   - package-ecosystem: npm
@@ -64,7 +67,8 @@ updates:
         patterns:
           - '*'
     schedule:
-      interval: daily
+      day: thursday
+      interval: weekly
     target-branch: main
 
   - package-ecosystem: pip
@@ -81,7 +85,8 @@ updates:
         patterns:
           - '*'
     schedule:
-      interval: daily
+      day: thursday
+      interval: weekly
     target-branch: main
 
   - package-ecosystem: pre-commit
@@ -95,7 +100,8 @@ updates:
         patterns:
           - '*'
     schedule:
-      interval: daily
+      day: thursday
+      interval: weekly
     target-branch: main
 
   - package-ecosystem: terraform
@@ -109,5 +115,6 @@ updates:
         patterns:
           - '*'
     schedule:
-      interval: daily
+      day: thursday
+      interval: weekly
     target-branch: main

.github/pr-labeler.yml

@@ -49,7 +49,7 @@ infrastructure:
 makefile:
   - changed-files:
       - any-glob-to-any-file:
-          - '**/Makefile'
+          - '**/[Mm]akefile'
 
 nestbot:
   - changed-files:

.github/workflows/check-contribution.yaml

@@ -8,14 +8,16 @@ on:
       - reopened
       - synchronize
 
+permissions: {}
+
 jobs:
   check-contribution:
     if: github.event.pull_request.base.repo.full_name == github.repository
     permissions:
       contents: read
       issues: read
       pull-requests: write
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-26.04-arm
     steps:
       - name: Check contribution requirements
         uses: arkid15r/check-contribution-action@f90721e95e8b5d7f32b8e565552498d51d052ca5  # v0.1.7

.github/workflows/ci-cd-production.yaml

@@ -19,7 +19,7 @@ jobs:
     name: Run production CI/CD
     if: github.event.repository.fork == false
     permissions:
-      actions: write
+      actions: read
       attestations: write
       contents: write
       id-token: write

.github/workflows/ci-cd-staging.yaml

@@ -19,7 +19,7 @@ jobs:
     name: Run staging CI/CD
     if: github.event.repository.fork == false
     permissions:
-      actions: write
+      actions: read
       attestations: write
       contents: write
       id-token: write

.github/workflows/ci.yaml

@@ -31,7 +31,7 @@ jobs:
     needs:
       - run-code-checks
     permissions:
-      actions: write
+      actions: read
       contents: read
       id-token: write
     secrets:

.github/workflows/cluster-fuzz-lite.yaml

@@ -31,7 +31,7 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -55,7 +55,7 @@ jobs:
 
       - name: Upload SARIF to code scanning
         if: always() && hashFiles('artifacts/fuzz-latest/fuzzing-report.sarif') != ''
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           category: cluster-fuzz-lite
           sarif_file: artifacts/fuzz-latest/fuzzing-report.sarif