[CI] Fix workflows permissions

.github/dependabot.yml

@@ -0,0 +1,42 @@
+# Copyright 2024 Iguazio
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+version: 2
+updates:
+  # GitHub Actions updates
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "[Dependabot]"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "github-actions"
+
+  # Docker updates
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "[Dependabot]"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "docker"

.github/workflows/ci.yaml

@@ -20,6 +20,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/rebuild-release.yaml

@@ -27,6 +27,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   get-release-tag:
     runs-on: ubuntu-latest

.github/workflows/release.yaml

@@ -19,6 +19,9 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest

Dockerfile

@@ -13,7 +13,7 @@
 # limitations under the License.
 #
 
-ARG GRAFANA_VERSION=latest
+ARG GRAFANA_VERSION=11.5.6
 FROM grafana/grafana:${GRAFANA_VERSION} AS plugins_fetcher
 
 RUN grafana cli plugins install agenty-flowcharting-panel \
@@ -38,14 +38,16 @@ RUN grafana cli plugins install agenty-flowcharting-panel \
     && grafana cli plugins install yesoreyeram-boomtable-panel \
     && grafana cli plugins install tdengine-datasource
 
-ARG GRAFANA_VERSION=latest
+ARG GRAFANA_VERSION=11.5.6
 FROM grafana/grafana:${GRAFANA_VERSION}
 
-# update OS packages
+# update OS packages for security patches
 USER root
 # This build arg ensures the following RUN command always executes (cache invalidation)
 ARG BUILD_DATE
-RUN apk upgrade --no-cache
+RUN apk upgrade --no-cache \
+    && apk add --no-cache --upgrade busybox \
+    && rm -rf /var/cache/apk/*
 
 USER grafana
 COPY --from=plugins_fetcher /var/lib/grafana/plugins /opt/plugins