SEKOIA-IO · gcl-sekoia · Mar 24, 2026 · Mar 24, 2026 · Mar 24, 2026 · Mar 24, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -8,6 +8,12 @@ updates:
       - "github_actions"
       - "dependencies"
       - "docs-approved"
+    cooldown:
+      default-days: 14
+    groups:
+      github-actions:
+        applies-to: version-updates
+        patterns: ["*"]
 
   - package-ecosystem: "npm"
     directory: "/"

diff --git a/.github/workflows/auto-merge-dockers.yml b/.github/workflows/auto-merge-dockers.yml
@@ -10,6 +10,8 @@ permissions:
 
 jobs:
   auto_approve_and_merge:
+    permissions:
+      pull-requests: write  # for dependabot to enable auto-approve
     runs-on: ubuntu-latest
     if: startsWith(github.head_ref, 'demisto/') && github.repository == 'demisto/content' && contains(github.event.pull_request.labels.*.name, 'docker-image-auto-update')
     steps:
@@ -35,7 +37,7 @@ jobs:
       - name: Post to a Slack channel
         if: ${{ failure() }}
         id: slack
-        uses: slackapi/slack-github-action@v1.24.0  # disable-secrets-detection
+        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
         with:
           channel-id: 'auto-merge-docker-action'
           slack-message: "GitHub build result: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}"

diff --git a/.github/workflows/autobump_rn.yml b/.github/workflows/autobump_rn.yml
@@ -20,22 +20,22 @@ jobs:
         env:
           GITHUB_CONTEXT: ${{ toJSON(github) }}
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           token: ${{ secrets.CONTENTBOT_GH_ADMIN_TOKEN }}
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
       - name: Setup Poetry
-        uses: Gr1N/setup-poetry@v9
+        uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       - name: Install python dependencies
         run: |
           poetry install --with github-actions
       - name: set pythonpath
         run: |
-          echo "PYTHONPATH=$GITHUB_WORKSPACE" >> $GITHUB_ENV
+          echo "PYTHONPATH=$GITHUB_WORKSPACE" >> "$GITHUB_ENV"
       - name: Check conflicts and add release notes
         env:
           CONTENTBOT_GH_ADMIN_TOKEN: ${{ secrets.CONTENTBOT_GH_ADMIN_TOKEN }}
@@ -45,4 +45,4 @@ jobs:
           git config --global user.email "[email protected]"
           git config --global user.name "Content Bot"
           echo "Someone merged to master. Starting to check if conflicts in release notes created."
-          poetry run python .github/github_workflow_scripts/autobump_rn.py -g $CONTENTBOT_GH_ADMIN_TOKEN -r $RUN_ID
+          poetry run python .github/github_workflow_scripts/autobump_rn.py -g "$CONTENTBOT_GH_ADMIN_TOKEN" -r "$RUN_ID"
diff --git a/.github/workflows/check-contribution-form-filled.yml b/.github/workflows/check-contribution-form-filled.yml
@@ -8,26 +8,29 @@ permissions:
 
 jobs:
   contribution_form_filled_verification:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for run step (declared via comment)
     runs-on: ubuntu-latest
     # This status check only runs for: forked PRS that don't contain the '[Marketplace Contribution]' in their title and the head branch is not a test branch.
     if: github.repository == 'demisto/content' && github.event.pull_request.head.repo.fork == true && contains(github.head_ref, 'xsoar-bot-contrib-ContributionTestPack') == false && contains(github.event.pull_request.title, '[Marketplace Contribution]') == false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
       - name: Setup Poetry
-        uses: Gr1N/setup-poetry@v9
+        uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       - name: Install Python Dependencies
         run: |
           poetry install --with github-actions
       - name: Check if contribution form needs to be filled
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # gha-perms:permissions=pull-requests:read
         run: |
           echo "Checking if contribution form needs to be filled for PR: $PR_NUMBER"
           cd .github/github_workflow_scripts
-          poetry run ./check_if_needs_to_fill_contribution_form.py --pr_number $PR_NUMBER --github_token $GITHUB_TOKEN
+          poetry run ./check_if_needs_to_fill_contribution_form.py --pr_number "$PR_NUMBER" --github_token "$GITHUB_TOKEN"
diff --git a/.github/workflows/check-contributor-pack.yml b/.github/workflows/check-contributor-pack.yml
@@ -9,23 +9,26 @@ permissions:
 
 jobs:
   check_contributor_pack:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: write  # for run step (declared via comment)
     runs-on: ubuntu-latest
     if: github.repository == 'demisto/content' && startsWith(github.head_ref, 'contrib/') == false && startsWith(github.head_ref, 'to-merge/') == false && contains(github.head_ref, 'xsoar-bot-contrib-ContributionTestPack') == false && github.event.pull_request.head.repo.fork == false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.8"
       - name: Setup Poetry
-        uses: Gr1N/setup-poetry@v9
+        uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       - name: Install python dependencies
         run: |
           poetry install --with github-actions
       - name: Check pack and request review
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # gha-perms:permissions=pull-requests:write
           PR_NUMBER: ${{ github.event.pull_request.number }}
           BRANCH_NAME: ${{ github.head_ref }}
           SENDGRID_EMAIL_API_KEY: ${{ secrets.SENDGRID_EMAIL_API_KEY }}
@@ -34,5 +37,5 @@ jobs:
           echo "PR number is: $PR_NUMBER"
           echo "Target branch name is: $BRANCH_NAME"
           echo "Starting check of contributor packs"
-          poetry run python ./.github/github_workflow_scripts/request_contributor_review.py --pr_number $PR_NUMBER --github_token $GITHUB_TOKEN --email_api_token $SENDGRID_EMAIL_API_KEY
+          poetry run python ./.github/github_workflow_scripts/request_contributor_review.py --pr_number "$PR_NUMBER" --github_token "$GITHUB_TOKEN" --email_api_token "$SENDGRID_EMAIL_API_KEY"
           echo "Finished check of contributor packs"
diff --git a/.github/workflows/check-devcontainer.yml b/.github/workflows/check-devcontainer.yml
@@ -14,16 +14,20 @@ on:
       - pyproject.toml
       - poetry.lock
       - .github/workflows/check-devcontainer.yml
+permissions: {}
+
 jobs:
   Build-Devcontainer:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Run demisto-sdk in devcontainer
-      uses: devcontainers/ci@v0.3  # disable-secrets-detection
+      uses: devcontainers/ci@8bf61b26e9c3a98f69cb6ce2f88d24ff59b785c6 # v0.3.1900000417
       with:    
         push: never
         runCmd: demisto-sdk --version
diff --git a/.github/workflows/check-partner-approved-label.yml b/.github/workflows/check-partner-approved-label.yml
@@ -8,30 +8,33 @@ permissions:
 
 jobs:
   check_label_job:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for run step (declared via comment)
     runs-on: ubuntu-latest
     if: github.repository == 'demisto/content' && github.event.pull_request.head.repo.fork == true && contains(github.head_ref, 'xsoar-bot-contrib-ContributionTestPack') == false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
       - name: Setup Poetry
-        uses: Gr1N/setup-poetry@v9
+        uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       - name: Install python dependencies
         run: |
           poetry install --with github-actions
       - name: set pythonpath
         run: |
-          echo "PYTHONPATH=$GITHUB_WORKSPACE" >> $GITHUB_ENV
+          echo "PYTHONPATH=$GITHUB_WORKSPACE" >> "$GITHUB_ENV"
 
       - name: Check if partner-approved label exists
         id: check_label
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # gha-perms:permissions=pull-requests:read
         run: |
           echo "Checking label Partner-Approved for: $PR_NUMBER"
           cd .github/github_workflow_scripts
-          poetry run python check_if_partner_approved_label_exists.py --pr_number $PR_NUMBER --github_token $GITHUB_TOKEN
+          poetry run python check_if_partner_approved_label_exists.py --pr_number "$PR_NUMBER" --github_token "$GITHUB_TOKEN"
diff --git a/.github/workflows/clean_stale_branches.yml b/.github/workflows/clean_stale_branches.yml
@@ -9,15 +9,19 @@ env:
   OPERATION_PER_RUN: 1000
   EXEMPT_LABELS: "Ignore Stale,External PR"
 
+permissions: {}
+
 jobs:
   stale:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
     runs-on: ubuntu-latest
     if: github.repository == 'demisto/content' && github.event.pull_request.head.repo.fork == false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Stale
-        uses: actions/stale@v8
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           repo-token: ${{ secrets.CONTENTBOT_GH_ADMIN_TOKEN }}
           days-before-issue-stale: -1

diff --git a/.github/workflows/close_jira_issue_by_pr_merge.yml b/.github/workflows/close_jira_issue_by_pr_merge.yml
@@ -8,18 +8,20 @@ permissions:
 
 jobs:
   add_pr_link_to_related_jira_issue:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
     runs-on: ubuntu-latest
     if: github.repository == 'demisto/content' && github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]' && github.event.action == 'closed' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'contrib/') == false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
       - name: Setup Poetry
-        uses: Gr1N/setup-poetry@v9
-      - uses: actions/cache@v2
+        uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
+      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: .venv
           key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
@@ -38,4 +40,4 @@ jobs:
         run: |
           echo "Checking for related Jira issues to PR: $PR_NUMBER"
           cd .github/github_workflow_scripts/jira_integration_scripts
-          poetry run python ./link_pr_to_jira_issue.py --url "$INSTANCE_URL" --pr_num "$PR_NUMBER" --pr_link "$PR_LINK" --pr_title "$PR_TITLE" --pr_body "$PR_BODY" --is_merged --username $USERNAME --password $PASSWORD
+          poetry run python ./link_pr_to_jira_issue.py --url "$INSTANCE_URL" --pr_num "$PR_NUMBER" --pr_link "$PR_LINK" --pr_title "$PR_TITLE" --pr_body "$PR_BODY" --is_merged --username "$USERNAME" --password "$PASSWORD"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -7,14 +7,16 @@ on:
   schedule:
     - cron: '27 11 * * 2'
 
+permissions: {}
+
 jobs:
   analyze:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
     name: Analyze
     runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
 
     strategy:
       fail-fast: false
@@ -24,18 +26,18 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
       with:
         languages: ${{ matrix.language }}
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
       with:
         category: "/language:${{matrix.language}}"
         queries:
           # exclude polluting-import as this is how we import from demistomock and CommonServerPython
-          "exclude: py/polluting-import"
+          "exclude: py/polluting-import"
diff --git a/.github/workflows/create-internal-pr-from-external.yml b/.github/workflows/create-internal-pr-from-external.yml
@@ -10,20 +10,23 @@ permissions:
 
 jobs:
   create_internal_pr:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: write  # for run step (declared via comment)
     runs-on: ubuntu-latest
     if: github.repository == 'demisto/content' && github.event.action == 'closed' && github.event.pull_request.merged == true && github.event.pull_request.head.repo.fork == true
     steps:
       - name: set pythonpath
         run: |
-          echo "PYTHONPATH=$GITHUB_WORKSPACE" >> $GITHUB_ENV
+          echo "PYTHONPATH=$GITHUB_WORKSPACE" >> "$GITHUB_ENV"
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
       - name: Setup Poetry
-        uses: Gr1N/setup-poetry@v9
+        uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       - name: Print Context
         run: |
           echo "$GITHUB_CONTEXT"
@@ -37,15 +40,16 @@ jobs:
         env:
           CONTENTBOT_GH_ADMIN_TOKEN: ${{ secrets.CONTENTBOT_GH_ADMIN_TOKEN }}
           EVENT_PAYLOAD: ${{ toJson(github.event) }}
+          GITHUB_EVENT_PULL_REQUEST_HTML_URL: ${{ github.event.pull_request.html_url }}
         run: |
-          echo "Creating an internal PR from original merged external PR ${{ github.event.pull_request.html_url }}"
+          echo "Creating an internal PR from original merged external PR ${GITHUB_EVENT_PULL_REQUEST_HTML_URL}"
           cd .github/github_workflow_scripts
           poetry run ./create_internal_pr.py
           echo "Finished Creating Internal PR"
 
       - name: Notify External PR Merge
         env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}  # gha-perms:permissions=pull-requests:write
           PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
           echo "Add a comment"

diff --git a/.github/workflows/handle-new-external-pr.yml b/.github/workflows/handle-new-external-pr.yml
@@ -8,20 +8,22 @@ permissions:
 
 jobs:
   handle_new_external_pr:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
     runs-on: ubuntu-latest
     if: github.repository == 'demisto/content' && github.event.action == 'opened' && github.event.pull_request.head.repo.fork == true && contains(github.head_ref, 'xsoar-bot-contrib-ContributionTestPack') == false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
       - name: Setup Poetry
-        uses: Gr1N/setup-poetry@v9
+        uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       - name: Print Context
         run: |
           echo "$GITHUB_CONTEXT"
@@ -33,13 +35,14 @@ jobs:
           poetry install --with github-actions
       - name: set pythonpath
         run: |
-          echo "PYTHONPATH=$GITHUB_WORKSPACE" >> $GITHUB_ENV
+          echo "PYTHONPATH=$GITHUB_WORKSPACE" >> "$GITHUB_ENV"
       - name: Update External PR
         env:
           CONTENTBOT_GH_ADMIN_TOKEN: ${{ secrets.CONTENTBOT_GH_ADMIN_TOKEN }}
           EVENT_PAYLOAD: ${{ toJson(github.event) }}
+          GITHUB_EVENT_PULL_REQUEST_HTML_URL: ${{ github.event.pull_request.html_url }}
         run: |
-          echo "Updating External PR ${{ github.event.pull_request.html_url }}"
+          echo "Updating External PR ${GITHUB_EVENT_PULL_REQUEST_HTML_URL}"
           cd .github/github_workflow_scripts
           poetry run ./handle_external_pr.py
           echo "Finished Handling External PR"
@@ -59,7 +62,8 @@ jobs:
           CONTENTBOT_GH_ADMIN_TOKEN: ${{ secrets.CONTENTBOT_GH_ADMIN_TOKEN }}
           EVENT_PAYLOAD: ${{ toJson(github.event) }}
           CORTEX_XSOAR_SLACK_TOKEN: ${{ secrets.CORTEX_XSOAR_SLACK_TOKEN }}
+          GITHUB_EVENT_PULL_REQUEST_HTML_URL: ${{ github.event.pull_request.html_url }}
         run: |
-          echo "Sending notification about External PR ${{ github.event.pull_request.html_url }}"
+          echo "Sending notification about External PR ${GITHUB_EVENT_PULL_REQUEST_HTML_URL}"
           cd .github/github_workflow_scripts
           poetry run ./send_slack_message.py