Update workflows: enhance cleanup job, add permissions, and improve vulnerability scan logic

Signed-off-by: kmilo <kmilo.denis.glez@yandex.com>

Author: kmilodenisglez

.github/workflows/cleanup.yml

@@ -2,7 +2,6 @@ name: Cleanup Old Workflow Runs
 
 on:
   schedule:
-    # Run daily at 2 AM UTC
     - cron: '0 2 * * *'
   workflow_dispatch:
     inputs:
@@ -14,7 +13,7 @@ on:
 jobs:
   cleanup:
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 30
     concurrency:
       group: workflow-cleanup
       cancel-in-progress: false
@@ -41,6 +40,7 @@ jobs:
             });
 
             let deletedCount = 0;
+            let failedCount = 0;
             for (const workflow of workflows) {
               const runs = await github.paginate(github.rest.actions.listWorkflowRuns, {
                 owner,
@@ -60,9 +60,10 @@ jobs:
                   await github.rest.actions.deleteWorkflowRun({ owner, repo, run_id: run.id });
                   deletedCount++;
                 } catch (error) {
+                  failedCount++;
                   console.log(`Failed to delete run ${run.id}: ${error.message}`);
                 }
               }
             }
 
-            console.log(`Deleted ${deletedCount} workflow runs`);
+            console.log(`Deleted ${deletedCount} workflow runs, ${failedCount} failures`);

.github/workflows/pull_request.yml

@@ -6,6 +6,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -18,7 +21,7 @@ jobs:
     uses: ./.github/workflows/scan.yml
 
   pull-request:
-    needs: test
+    needs: [test, scan]
     name: Pull request success
     runs-on: ubuntu-latest
     steps:

.github/workflows/push.yml

@@ -1,6 +1,3 @@
-# Copyright the Hyperledger Fabric contributors. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
 name: Push
 
 on:
@@ -9,6 +6,12 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    uses: ./.github/workflows/test.yaml
+    uses: ./.github/workflows/test.yaml
+
+  scan:
+    uses: ./.github/workflows/scan.yml

.github/workflows/release.yml

@@ -9,14 +9,13 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
-      packages: write
 
     steps:
       - uses: actions/checkout@v4
@@ -32,16 +31,16 @@ jobs:
       - name: Install build dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install build setuptools wheel
+          python -m pip install build setuptools wheel
 
       - name: Build distribution
-        run: |
-          python -m build --sdist --wheel
+        run: python -m build --sdist --wheel
 
+      # Recommended future improvement: migrate to Trusted Publishing (OIDC).
+      # Requires: permissions: id-token: write, remove 'password',
+      # and configure the publisher on pypi.org.
       - name: Publish to PyPI
         if: startsWith(github.ref, 'refs/tags/')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
-          repository: ${{ github.repository }}
-          skip_existing_packages: true
+          password: ${{ secrets.PYPI_API_TOKEN }}

.github/workflows/scan.yml

@@ -15,6 +15,8 @@ permissions:
 jobs:
   scan:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+
     steps:
       - uses: actions/checkout@v4
         with:
@@ -27,13 +29,16 @@ jobs:
           python-version: '3.11'
           cache: 'pip'
 
-      - name: Install dependencies for scanning
+      - name: Install project dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install safety
+          python -m pip install -r requirements.txt
+
+      - name: Install pip-audit
+        run: python -m pip install pip-audit
 
-      - name: Scan dependencies
-        run: safety check --full-report
+      - name: Audit requirements.txt
+        run: pip-audit -r requirements.txt
 
-      - name: Scan source code
-        run: safety check -r requirements.txt
+      - name: Audit installed environment
+        run: pip-audit

.github/workflows/test.yaml

@@ -1,21 +1,8 @@
-# Copyright the Hyperledger Fabric contributors. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
 name: Test
 
 on:
-  pull_request:
-    branches:
-      - main
-  push:
-    branches:
-      - main
   workflow_call:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
@@ -41,5 +28,4 @@ jobs:
           python -m pip install -r requirements.txt pytest pytest-asyncio
 
       - name: Run tests
-        run: |
-          python -m pytest -q
+        run: python -m pytest -q

.github/workflows/vulnerability-scan.yml

@@ -1,4 +1,4 @@
-name: "Security vulnerability scan"
+name: "Scheduled vulnerability scan"
 
 on:
   schedule:
@@ -12,11 +12,20 @@ jobs:
   latest-release-version:
     name: Get latest release tag
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       tag_name: ${{ steps.tag-name.outputs.value }}
     steps:
       - id: tag-name
-        run: echo "value=$(curl --location --silent --fail "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/latest" | jq --raw-output '.tag_name')" >> "${GITHUB_OUTPUT}"
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq '.tag_name')"
+          if [ -z "${tag}" ] || [ "${tag}" = "null" ]; then
+            echo "::error::No releases found in ${GITHUB_REPOSITORY}"
+            exit 1
+          fi
+          echo "value=${tag}" >> "${GITHUB_OUTPUT}"
 
   scan:
     name: Scan ${{ needs.latest-release-version.outputs.tag_name }}