Minor security hardening

.github/dependabot.yml

@@ -15,3 +15,12 @@ updates:
         applies-to: version-updates
         patterns:
           - "k8s.io/*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/.github"
+    schedule:
+      interval: "monthly"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/build_image_pr.yml

@@ -16,7 +16,7 @@ jobs:
     name: Build PR image and upload artifact
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: Install make
@@ -29,15 +29,15 @@ jobs:
           USER=netobserv VERSION=${head_sha::8} make commands
       - name: upload commands
         id: artifact-upload-step
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: commands
           path: build/
       - name: save commands URL
         run: |
           echo ${{ steps.artifact-upload-step.outputs.artifact-url }} > ./out/commands-url
       - name: upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: pr
           path: out/

.github/workflows/on-release.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: Call krew-release-bot

.github/workflows/pull_request.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
       with:
         go-version: '1.26'
     - name: Install make

.github/workflows/pull_request_e2e.yml

@@ -22,19 +22,19 @@ jobs:
         sudo cp oc kubectl /usr/local/bin
         oc version
     - name: set up go 1.x
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
       with:
         go-version: '1.26'
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - name: get kernel version
       run: uname -r
     - name: run end-to-end tests
       run: make tests-e2e
     - name: upload e2e test logs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       if: always()
       with:
         name: e2e-logs

.github/workflows/push_image.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: docker login to quay.io
@@ -51,11 +51,12 @@ jobs:
     - name: install make
       run: sudo apt-get install make
     - name: set up go 1.x
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
       with:
         go-version: '1.26'
+        cache: false
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - name: Test

.github/workflows/push_image_pr.yml

@@ -41,7 +41,7 @@ jobs:
           echo "short_sha=$(echo ${head_sha::8})" >> $GITHUB_ENV
           echo "main_image=${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${head_sha::8}" >> $GITHUB_ENV
       - name: download artifact
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: pr
           run-id: ${{github.event.workflow_run.id }}
@@ -59,7 +59,7 @@ jobs:
       - name: push images
         run: |
           DOCKER_BUILDKIT=1 docker push ${{ env.main_image }}
-      - uses: actions/github-script@v9
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - name: validate tag
@@ -48,23 +48,12 @@ jobs:
         run: MULTIARCH_TARGETS="${{ env.WF_MULTIARCH_TARGETS }}" IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.tag }} CLEAN_BUILD=1 make images
       - name: build plugin artifact
         run: IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.tag }} make release
-      - name: create github release
-        uses: actions/create-release@v1
-        id: create_release
+      - name: create draft release and upload binaries
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
+          tag_name: ${{ env.tag }}
+          name: ${{ env.tag }}
           draft: true
           prerelease: false
-          release_name: ${{ env.tag }}
-          tag_name: ${{ env.tag }}
+          files: netobserv-cli.tar.gz
           body: Edit to remove this content, click on 'generate release notes' above and publish. It will trigger the krew-release-bot.
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: push plugin artifact
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: netobserv-cli.tar.gz
-          asset_name: netobserv-cli.tar.gz
-          asset_content_type: application/gzip

cmd/prom.go

@@ -61,7 +61,7 @@ func newTransport(timeout time.Duration, skipTLS bool, capath string, userCertPa
 		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
 		log.Debugf("skipping TLS checks. SSL certificate verification is now disabled !")
 	} else if capath != "" || userCertPath != "" {
-		transport.TLSClientConfig = &tls.Config{}
+		transport.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS13}
 
 		if capath != "" {
 			caCert, err := os.ReadFile(capath)