ci: address OSSF Scorecard warnings

alessfg commented 3 months ago

This PR aims to:

Remediate the Token-Permissions warning/low score by moving the F5 CLA GH Action permissions around.
Remediate the Pinned-Dependencies warning/low score by using specific Docker image SHAs and adding Docker image updates to Dependabot.
Hopefully remediate the Vulnerabilities warning/low score by recreating package-lock.json.
Add both workflow_dispatch and cron builds to the OSSF Scorecard and S3 Gateway GitHub Actions in order to more proactively test changes (and to ensure that the pipelines run at minimum once a week).

Before creating a PR, run through this checklist and mark each as complete:

[x] I have read the contributing guidelines.
[x] I have signed the F5 Contributor License Agreement (CLA).
[x] If applicable, I have added tests that prove my fix is effective or that my feature works.
[x] If applicable, I have checked that any relevant tests pass after adding my changes.
[x] I have updated any relevant documentation (e.g. README.md).

github-actions[bot] commented 3 months ago

CLA Assistant Lite bot ✅ All required contributors have signed the F5 CLA for this PR. Thank you!

alessfg commented 3 months ago

recheck

alessfg commented 3 months ago

I have hereby read the F5 CLA and agree to its terms

alessfg commented 3 months ago

recheck

nginxinc / nginx-s3-gateway