Merge branch 'main' into fix/virtual-servers-select-all-count

Author: Nayana-R-Gowda

.github/CODEOWNERS

@@ -1,5 +1,6 @@
 # All files in the repo
 * @crivetimihai
+/.github/workflows/ @crivetimihai
 
 # Plugin framework
 /mcpgateway/plugins @araujof @terylt @jonpspri

.github/actionlint.yaml

@@ -0,0 +1,4 @@
+self-hosted-runner:
+  labels:
+    - ubuntu-24.04-s390x
+    - ubuntu-24.04-ppc64le

.github/workflows/alembic-upgrade-validation.yml

@@ -43,13 +43,15 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Build candidate image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: Containerfile.lite
@@ -66,7 +68,7 @@ jobs:
 
       - name: Upload upgrade validation logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: alembic-upgrade-validation-logs
           path: artifacts/upgrade-validation

.github/workflows/bandit.yml

@@ -32,6 +32,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   bandit:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
@@ -48,7 +51,9 @@ jobs:
       # 0️⃣  Check out the repository
       # -----------------------------------------------------------
       - name: ⬇️  Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
 
       # -----------------------------------------------------------
       # 1️⃣  Run Bandit with custom filters

.github/workflows/codeql.yml

@@ -69,14 +69,16 @@ jobs:
       # 0️⃣  Check out the repository
       # -----------------------------------------------------------
       - name: ⬇️  Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
 
       # -----------------------------------------------------------
       # 1️⃣  Dependency & License gate
       # -----------------------------------------------------------
       - name: 🔍  Dependency Review
         id: dep-scan
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
         with:
           # ───────── Vulnerability policy ─────────
           fail-on-severity: moderate # MODERATE, HIGH, CRITICAL ⇒ ❌