From e9ad2414165f275aed499584fdfc5283400ed2c0 Mon Sep 17 00:00:00 2001
From: Jake Jackson <24478650+thedoubl3j@users.noreply.github.com>
Date: Fri, 23 Oct 2026 09:28:24 -0400
Subject: [PATCH] Stop using floating Python 3.x in docs and label_pr CI
 (#16753)

* Stop using floating Python 3.x in docs and label_pr CI

The python-version: '3.x' specifier resolved to Python 3.15.0 on newer
runner images, causing rpds-py to fail to build (no pre-built wheel).
Removing the override lets the setup-python composite action derive the
version from the Makefile, consistent with the rest of CI.


* Fix SonarCloud security findings in docs and label_pr workflows

Pin pip dependencies with --only-binary :all: to prevent execution of
setup scripts, scope write permissions to job level instead of workflow
level, and use full commit SHA for third-party action.


* fix yaml syntax

* update yaml syntax so all run is recongnized correctly

* Add least-privilege permissions to docs workflow


* Disable credential persistence in docs workflow checkout

Prevents tox and dependency code from accessing the GitHub token
stored in .git/config.

Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/docs.yml     |  7 ++++---
 .github/workflows/label_pr.yml | 17 ++++++++---------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index ec6c9f4a4f..5228268d7b 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -7,17 +7,18 @@ jobs:
     name: docsite test build
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           show-progress: false
 
       - uses: ./.github/actions/setup-python
-        with:
-          python-version: '3.x'
 
       - name: install tox
-        run: pip install tox
+        run: 'pip install --only-binary :all: tox==4.67.1'
 
       - name: Assure docs can be built
         run: tox -e docs
diff --git a/.github/workflows/label_pr.yml b/.github/workflows/label_pr.yml
index 43f1e3a291..8da7f2053d 100644
--- a/.github/workflows/label_pr.yml
+++ b/.github/workflows/label_pr.yml
@@ -7,16 +7,14 @@ on:
       - reopened
       - synchronize
 
-permissions:
-  contents: write # to determine modified files (actions/labeler)
-  pull-requests: write # to add labels to PRs (actions/labeler)
-
 jobs:
   triage:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     name: Label PR
-
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Label PR
         uses: actions/labeler@v3
@@ -28,19 +26,20 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     name: Label PR - Community
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
         with:
           show-progress: false
 
       - uses: ./.github/actions/setup-python
-        with:
-          python-version: '3.x'
 
       - name: Install python requests
-        run: pip install requests
+        run: 'pip install --only-binary :all: requests==2.34.2'
       - name: Check if user is a member of Ansible org
-        uses: jannekem/run-python-script-action@v1
+        uses: jannekem/run-python-script-action@9d8e2e0878d575fb6073277f38ce3f10ebf4f059 # v1
         id: check_user
         with:
           script: |