perf: Docker hardened images

.github/workflows/admin_fetch_updated_apps.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.ref_name }}
 

.github/workflows/admin_update_repo_settings.yml

@@ -20,7 +20,7 @@ jobs:
     if: ${{ github.ref_name == 'dev' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.ref_name }}
 
@@ -38,7 +38,7 @@ jobs:
     if: ${{ github.ref_name != 'prod' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.ref_name }}
 
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.ref_name }}
 

.github/workflows/az_acr_delete.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         repository: 'code-kern-ai/cicd-deployment-scripts'
 

.github/workflows/az_acr_push.yml

@@ -20,7 +20,7 @@ jobs:
         platform: [amd64, arm64]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: 'true'
 

.github/workflows/az_acr_release.yml

@@ -22,7 +22,7 @@ jobs:
       IMAGE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || github.sha }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: 'true'
 

.github/workflows/az_acr_test.yml

@@ -20,7 +20,7 @@ jobs:
       GH_REF_NAME: test-${{ steps.branch_name.outputs.GH_REF_NAME }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: 'true'
 

.github/workflows/az_fa_deploy.yml

@@ -15,7 +15,7 @@ jobs:
       PYTHON_VERSION: ${{ vars.PYTHON_VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: 'true'
 

.github/workflows/dc_deploy.yml

@@ -2,16 +2,6 @@ name: 'DC: Deploy'
 
 on:
   workflow_call:
-    secrets:
-      SSH_HOST:
-        required: true
-        description: "SSH host"
-      SSH_USER:
-        required: true
-        description: "SSH user"
-      SSH_PRIVATE_KEY:
-        required: true
-        description: "SSH private_key"
 
 # Special permissions required for OIDC authentication
 permissions:
@@ -40,7 +30,7 @@ jobs:
     if: github.event_name == 'pull_request' && github.event.pull_request.merged && !failure() && !cancelled()
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
 

.github/workflows/dc_edit.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         token: ${{ secrets.GH_TOKEN }}
         repository: ${{ github.repository_owner }}/${{ env.DEPLOYMENT_REPO_NAME }}

.github/workflows/dc_registry_delete.yml

@@ -35,7 +35,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         repository: 'code-kern-ai/cicd-deployment-scripts'
 

.github/workflows/dc_registry_delete_bulk.yml

@@ -37,7 +37,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout cicd-deployment-scripts
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         repository: 'code-kern-ai/cicd-deployment-scripts'
 
@@ -82,7 +82,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout cicd-deployment-scripts
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         repository: 'code-kern-ai/cicd-deployment-scripts'
 

.github/workflows/dc_release.yml

@@ -43,7 +43,7 @@ jobs:
     if: github.event_name == 'pull_request' && github.event.pull_request.merged && !failure() && !cancelled()
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
 

.github/workflows/gh_delete_branch.yml

@@ -70,7 +70,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
 

.github/workflows/k8s_apply.yml

@@ -28,7 +28,7 @@ jobs:
       AZURE_CONTAINER_REGISTRY: "${{ vars.AZURE_CONTAINER_REGISTRY }}"
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: GitHub Configuration
       run: git config --global url."https://oauth2:${{ secrets.GH_TOKEN }}@github.com".insteadOf https://github.com

.github/workflows/k8s_delete.yml

@@ -30,7 +30,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: GitHub Configuration
       run: git config --global url."https://oauth2:${{ secrets.GH_TOKEN }}@github.com".insteadOf https://github.com

.github/workflows/k8s_deploy.yml

@@ -39,7 +39,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         token: ${{ secrets.GH_TOKEN }}
         repository: ${{ github.repository_owner }}/${{ env.KUBERNETES_CLUSTER_REPO_NAME }}

.github/workflows/k8s_destroy.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: GitHub Configuration
       run: git config --global url."https://oauth2:${{ secrets.GH_TOKEN }}@github.com".insteadOf https://github.com

.github/workflows/k8s_edit.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         token: ${{ secrets.GH_TOKEN }}
         repository: ${{ github.repository_owner }}/${{ env.KUBERNETES_CLUSTER_REPO_NAME }}

.github/workflows/k8s_exec_env_pull.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: GitHub Configuration
       run: git config --global url."https://oauth2:${{ secrets.GH_TOKEN }}@github.com".insteadOf https://github.com

.github/workflows/k8s_release.yml

@@ -52,7 +52,7 @@ jobs:
     if: github.event_name == 'pull_request' && github.event.pull_request.merged && !failure() && !cancelled()
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
 

.github/workflows/k8s_reload_secrets.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: GitHub Configuration
       run: git config --global url."https://oauth2:${{ secrets.GH_TOKEN }}@github.com".insteadOf https://github.com

.github/workflows/k8s_restart.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: GitHub Configuration
       run: git config --global url."https://oauth2:${{ secrets.GH_TOKEN }}@github.com".insteadOf https://github.com

.github/workflows/k8s_test.yml

@@ -50,7 +50,7 @@ jobs:
     steps:
     # Checkout the repository to the GitHub Actions runner
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: GitHub Configuration
       run: git config --global url."https://oauth2:${{ secrets.GH_TOKEN }}@github.com".insteadOf https://github.com

.github/workflows/pi_build.yml

@@ -43,6 +43,8 @@ jobs:
       DEV_CONTAINER_REGISTRY: ${{ vars.DEV_CONTAINER_REGISTRY }}
       DEV_LOGIN_USERNAME: ${{ secrets.DEV_LOGIN_USERNAME }}
       DEV_LOGIN_PASSWORD: ${{ secrets.DEV_LOGIN_PASSWORD }}
+      DOCKERHUB_LOGIN_USERNAME: ${{ secrets.DOCKERHUB_LOGIN_USERNAME }}
+      DOCKERHUB_LOGIN_PASSWORD: ${{ secrets.DOCKERHUB_LOGIN_PASSWORD }}
       PARENT_IMAGE_NAME: ${{ vars.PARENT_IMAGE_NAME }}
       DOCKERFILE: ${{ vars.DOCKERFILE }}
       HEAD_REF: parent-image-updates
@@ -76,24 +78,31 @@ jobs:
           pip-compile requirements/${{ matrix.parent_image_type }}-requirements.in
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           platforms: linux/amd64,linux/arm64
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64,arm
 
       - name: Log into DEV registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: "${{ env.DEV_CONTAINER_REGISTRY }}"
           username: "${{ env.DEV_LOGIN_USERNAME }}"
           password: "${{ env.DEV_LOGIN_PASSWORD }}"
 
+      - name: Log into DHI registry
+        uses: docker/login-action@v4
+        with:
+          registry: "dhi.io"
+          username: "${{ env.DOCKERHUB_LOGIN_USERNAME }}"
+          password: "${{ env.DOCKERHUB_LOGIN_PASSWORD }}"
+
       - name: Build & Push ${{ env.PARENT_IMAGE_NAME }}:${{ env.HEAD_REF }}-${{ matrix.parent_image_type }}
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           cache-from: type=registry,ref=${{ env.DEV_CONTAINER_REGISTRY }}/${{ env.PARENT_IMAGE_NAME }}:dev-${{ matrix.parent_image_type }}-cache
@@ -107,7 +116,7 @@ jobs:
             label=dockerfile-path=https://github.com/refinery-${{ matrix.parent_image_type }}-parent-image/blob/${{ github.sha }}/${{ env.DOCKERFILE }}
 
       # - name: Build & Push ${{ env.PARENT_IMAGE_NAME }}:${{ env.HEAD_REF }}-${{ matrix.parent_image_type }}-arm64
-      #   uses: docker/build-push-action@v5
+      #   uses: docker/build-push-action@v7
       #   with:
       #     context: .
       #     cache-from: type=registry,ref=${{ env.DEV_CONTAINER_REGISTRY }}/${{ env.PARENT_IMAGE_NAME }}:dev-${{ matrix.parent_image_type }}-arm64-cache

.github/workflows/pi_cleanup_submodule.yml

@@ -30,7 +30,7 @@ jobs:
     needs: [configure-branch-name]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
 
@@ -47,7 +47,7 @@ jobs:
         app: ${{ fromJson(needs.pi-matrix.outputs.app) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.repository_owner }}/${{ matrix.app }}
           token: ${{ secrets.GH_TOKEN }}

.github/workflows/pi_matrix.yml

@@ -46,7 +46,7 @@ jobs:
       app: ${{ steps.generate-matrix.outputs.app }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ inputs.repository }}
           ref: ${{ inputs.checkout_ref }}

.github/workflows/pi_merge_submodule.yml

@@ -42,7 +42,7 @@ jobs:
         parent_image_type: ${{ fromJson(needs.pi-matrix.outputs.parent_image_type) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
           repository: '${{ github.repository_owner }}/refinery-${{ matrix.parent_image_type }}-parent-image'
@@ -68,7 +68,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
 

.github/workflows/pi_release.yml

@@ -40,7 +40,7 @@ jobs:
         app: ${{ fromJson(needs.pi-matrix.outputs.app) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
           repository: ${{ github.repository_owner }}/${{ matrix.app }}

.github/workflows/tf_docs.yml

@@ -11,7 +11,7 @@ jobs:
   tf-module-docs:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         ref: ${{ github.event.pull_request.head.ref }}