bump github actions, remove d/s leftovers, improve security

.github/workflows/build_image_pr.yml

@@ -7,13 +7,18 @@ env:
   WF_REGISTRY: quay.io/netobserv
   WF_IMAGE: network-observability-cli
 
+permissions:
+  contents: read
+
 jobs:
   build-pr-image:
     if: ${{ github.event.label.name == 'ok-to-test' }}
     name: Build PR image and upload artifact
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Install make
         run: sudo apt -y install make
       - name: get short sha

.github/workflows/on-release.yml

@@ -3,12 +3,17 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   update-krew:
     name: update krew
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Call krew-release-bot
         uses: rajatjindal/krew-release-bot@3d9faef30a82761d610544f62afddca00993eef9 # v0.0.47

.github/workflows/pull_request.yml

@@ -4,15 +4,20 @@ on:
   pull_request:
     branches: ['*']
 
+permissions:
+  contents: read
+
 jobs:
   build-test:
     name: Build, lint, test
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v6
       with:
         go-version: '1.25'
     - name: Install make

.github/workflows/pull_request_e2e.yml

@@ -2,11 +2,12 @@ name: pull request - e2e tests
 
 #todo: check caching dependencies: https://github.com/actions/cache
 on:
-  push:
-    branches: [ 'main', 'release-*' ]
   pull_request:
     branches: [ 'main', 'release-*' ]
 
+permissions:
+  contents: read
+
 jobs:
   e2e-tests:
     name: e2e-tests
@@ -21,11 +22,13 @@ jobs:
         sudo cp oc kubectl /usr/local/bin
         oc version
     - name: set up go 1.x
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v6
       with:
         go-version: '1.25'
     - name: checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: get kernel version
       run: uname -r
     - name: run end-to-end tests
@@ -38,4 +41,4 @@ jobs:
         path: |
           e2e-logs
           e2e/commands
-          e2e/output
+          e2e/output

.github/workflows/push_image.yml

@@ -9,9 +9,12 @@ env:
   WF_MULTIARCH_TARGETS: amd64 arm64 ppc64le s390x
   WF_VERSION: ${{ github.ref_name }}
 
+permissions:
+  contents: read
+
 jobs:
   push-image:
-    name: push image
+    name: build and push images
     runs-on: ubuntu-latest
     steps:
       - name: install make
@@ -21,12 +24,10 @@ jobs:
         uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0
-      - name: set up go 1.x
-        uses: actions/setup-go@v3
-        with:
-          go-version: '1.25'
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: docker login to quay.io
         uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
         with:
@@ -50,11 +51,13 @@ jobs:
     - name: install make
       run: sudo apt-get install make
     - name: set up go 1.x
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v6
       with:
         go-version: '1.25'
     - name: checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Test
       run: make test coverage-report
     - name: Report coverage
@@ -65,4 +68,4 @@ jobs:
         files: ./cover.out
         flags: unittests
         fail_ci_if_error: true
-        verbose: true
+        verbose: true

.github/workflows/push_image_pr.yml

@@ -34,7 +34,7 @@ jobs:
       - name: push images
         run: |
           DOCKER_BUILDKIT=1 docker push $(cat ./name)
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v9
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |

.github/workflows/release.yml

@@ -14,7 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: validate tag
         run: |
           tag=`git describe --exact-match --tags 2> /dev/null`
@@ -33,10 +35,6 @@ jobs:
         uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0
-      - name: set up go 1.x
-        uses: actions/setup-go@v3
-        with:
-          go-version: '1.25'
       - name: docker login to quay.io
         uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
         with: