Test

.github/workflows/docker-build-dev.yml

@@ -1,6 +1,4 @@
 name: Dev - Build & Push docker images
-permissions:
-  contents: read
 
 on:
   push:
@@ -42,6 +40,8 @@ jobs:
   Setup:
     runs-on: ubuntu-latest
     environment: dev
+    permissions:
+      contents: read
     steps:
     - name: Get variables
       run: |
@@ -61,6 +61,8 @@ jobs:
     needs: [Setup]
     runs-on: ubuntu-latest
     environment: dev
+    permissions:
+      contents: read
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
@@ -111,6 +113,8 @@ jobs:
     needs: [Setup,Branch,PushVariables]
     runs-on: ubuntu-latest
     environment: dev
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - name: Build Docker images
@@ -125,10 +129,10 @@ jobs:
         echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
     - name: Push application images to Artifactory container registry
       run: |
-        docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator
-        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator
-        docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web
-        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web
+        docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
+        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
+        docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
+        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
     - name: Disconnect docker from JFrog Artifactory
       run: |
         docker logout

.github/workflows/docker-build-main.yml

@@ -1,6 +1,4 @@
 name: Main - Build & Push docker images
-permissions:
-  contents: read
 
 on:
   push:
@@ -42,6 +40,8 @@ jobs:
   Setup:
     runs-on: ubuntu-latest
     environment: main
+    permissions:
+      contents: read
     steps:
     - name: Get variables
       run: |
@@ -61,6 +61,8 @@ jobs:
     needs: [Setup]
     runs-on: ubuntu-latest
     environment: main
+    permissions:
+      contents: read
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
@@ -168,6 +170,8 @@ jobs:
     needs: [Setup,Branch,GenerateTag,PushVariables]
     runs-on: ubuntu-latest
     environment: main
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - name: Build Docker images

.github/workflows/docker-build-test.yml

@@ -1,6 +1,4 @@
 name: Test - Build & Push docker images
-permissions:
-  contents: read
 
 on:
   push:
@@ -42,6 +40,8 @@ jobs:
   Setup:
     runs-on: ubuntu-latest
     environment: test
+    permissions:
+      contents: read
     steps:
     - name: Get variables
       run: |
@@ -61,6 +61,8 @@ jobs:
     needs: [Setup]
     runs-on: ubuntu-latest
     environment: test
+    permissions:
+      contents: read
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
@@ -89,6 +91,8 @@ jobs:
     needs: [Setup,Branch]
     runs-on: ubuntu-latest
     environment: test
+    permissions:
+      contents: write
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
@@ -114,6 +118,7 @@ jobs:
     needs: [Setup,Branch,GenerateTag]
     permissions:
       actions: write
+      contents: read
     runs-on: ubuntu-latest
     environment: test
     steps:
@@ -144,6 +149,8 @@ jobs:
     needs: [Setup,Branch,GenerateTag,PushVariables]
     runs-on: ubuntu-latest
     environment: test
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - name: Build Docker images
@@ -158,10 +165,10 @@ jobs:
         echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
     - name: Push application images to Artifactory container registry
       run: |
-        docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator
-        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator
-        docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web
-        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web
+        docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
+        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
+        docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
+        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
     - name: Disconnect docker from JFrog Artifactory
       run: |
         docker logout

.github/workflows/manual-trigger.yml

@@ -1,8 +1,6 @@
 # This is a basic workflow that is manually triggered
 
 name: Workflow - Run manual trigger
-permissions:
-  contents: read
 
 # Controls when the action will run. Workflow runs when manually triggered
 on:
@@ -39,6 +37,8 @@ jobs:
   Setup:
     runs-on: ubuntu-latest
     environment: ${{ inputs.name }}
+    permissions:
+      contents: read
     steps:
     - name: Get variables
       run: |
@@ -57,6 +57,8 @@ jobs:
     needs: [Setup]
     runs-on: ubuntu-latest
     environment: ${{ inputs.name }}
+    permissions:
+      contents: read
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
@@ -86,6 +88,7 @@ jobs:
     environment: ${{ inputs.name }}
     permissions:
       actions: write
+      contents: read
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
@@ -106,6 +109,8 @@ jobs:
     needs: [Setup,Branch,PushVariables]
     runs-on: ubuntu-latest
     environment: ${{ inputs.name }}
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - name: Build Docker images

.github/workflows/pr-check-dev-branch.yml

@@ -1,9 +1,5 @@
 name: Dev - Branch Protection - CI & Unit Tests
 
-permissions:
-  contents: read
-  pull-requests: write
-
 on:
   pull_request:
     branches:
@@ -15,6 +11,8 @@ jobs:
   # ---------------------------------------------------------------------
   check-dev-branch:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       branch-allowed: ${{ steps.branch-check.outputs.allowed }}
     steps:
@@ -41,6 +39,8 @@ jobs:
     needs: check-dev-branch
     if: needs.check-dev-branch.outputs.branch-allowed == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       matrix: ${{ steps.discover.outputs.matrix }}
     steps:
@@ -60,6 +60,8 @@ jobs:
   test-project:
     needs: discover-test-projects
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     strategy:
       fail-fast: false
@@ -69,7 +71,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@v5
         with:
           dotnet-version: "9.0.x"
 
@@ -85,7 +87,7 @@ jobs:
             --logger "trx;LogFileName=${NAME}.trx" \
             --results-directory TestResults
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: test-output-${{ strategy.job-index }}
           path: TestResults/
@@ -96,6 +98,9 @@ jobs:
   aggregate-results:
     needs: test-project
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -133,7 +138,7 @@ jobs:
           echo "failed=$FAILED" >> $GITHUB_OUTPUT
           echo "skipped=$SKIPPED" >> $GITHUB_OUTPUT
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: merged-test-results
           path: merged/

.github/workflows/pr-check-main-branch.yml

@@ -1,8 +1,4 @@
 name: Main - Branch Protection - CI & Unit Tests
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
 
 on:
   pull_request:
@@ -15,6 +11,8 @@ jobs:
   # ---------------------------------------------------------------------  
   check-main-branch:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       branch-allowed: ${{ steps.branch-check.outputs.allowed }}    
     steps:
@@ -37,6 +35,8 @@ jobs:
     needs: check-main-branch
     if: needs.check-main-branch.outputs.branch-allowed == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       matrix: ${{ steps.discover.outputs.matrix }}
     steps:
@@ -56,6 +56,8 @@ jobs:
   test-project:
     needs: discover-test-projects
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     strategy:
       fail-fast: false
@@ -65,7 +67,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@v5
         with:
           dotnet-version: "9.0.x"
 
@@ -81,7 +83,7 @@ jobs:
             --logger "trx;LogFileName=${NAME}.trx" \
             --results-directory TestResults
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: test-output-${{ strategy.job-index }}
           path: TestResults/
@@ -92,6 +94,10 @@ jobs:
   aggregate-results:
     needs: test-project
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -129,7 +135,7 @@ jobs:
           echo "failed=$FAILED" >> $GITHUB_OUTPUT
           echo "skipped=$SKIPPED" >> $GITHUB_OUTPUT
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: merged-test-results
           path: merged/