fix: fixed the token-permission and pinned dependencies issue

.github/workflows/code_verify.yaml

@@ -7,6 +7,9 @@ on:
     tags:
   pull_request:
 
+permissions:  
+  contents: read
+
 jobs:
   verify:
     runs-on: ubuntu-24.04
@@ -16,17 +19,17 @@ jobs:
       GOPATH: /home/runner/work/${{ github.repository }}
     steps:
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: 1.22.x
 
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           fetch-depth: 0
           path: ./src/github.com/${{ github.repository }}
 
-      - uses: actions/cache@v2
+      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}

.github/workflows/codeql-analysis.yml

@@ -20,6 +20,9 @@ on:
   schedule:
     - cron: '15 16 * * 3'
 
+permissions:  
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -35,11 +38,12 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@e8b34a2aaa1d35eab0b758128337086bb22bc6bf # v2.26.5
+
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -50,7 +54,8 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@e8b34a2aaa1d35eab0b758128337086bb22bc6bf # v2.26.5
+
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -64,4 +69,5 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@e8b34a2aaa1d35eab0b758128337086bb22bc6bf # v2.26.5
+

.github/workflows/e2e_parallel_jobs.yaml

@@ -7,14 +7,17 @@ on:
     tags:
   pull_request:
 
+permissions:  
+  contents: read
+
 jobs:
   e2e_parallel_jobs:
     runs-on: ubuntu-24.04
     name: E2E about Parallel Jobs
     timeout-minutes: 40
     steps:
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: 1.22.x
 
@@ -24,7 +27,7 @@ jobs:
           tar -xf musl-1.2.1.tar.gz && cd musl-1.2.1
           ./configure
           make && sudo make install
-      - uses: actions/cache@v2
+      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -34,7 +37,7 @@ jobs:
           GO111MODULE="on" go install sigs.k8s.io/[email protected]
           curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.30.1/bin/linux/amd64/kubectl && sudo install kubectl /usr/local/bin/kubectl
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Run E2E Tests
         run: |

.github/workflows/e2e_scheduling_actions.yaml

@@ -7,14 +7,17 @@ on:
     tags:
   pull_request:
 
+permissions:  
+  contents: read
+
 jobs:
   e2e_scheduling_actions:
     runs-on: ubuntu-24.04
     name: E2E about Scheduling Actions
     timeout-minutes: 40
     steps:
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: 1.22.x
 
@@ -24,7 +27,7 @@ jobs:
           tar -xf musl-1.2.1.tar.gz && cd musl-1.2.1
           ./configure
           make && sudo make install
-      - uses: actions/cache@v2
+      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -34,7 +37,7 @@ jobs:
           GO111MODULE="on" go install sigs.k8s.io/[email protected]
           curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.30.1/bin/linux/amd64/kubectl && sudo install kubectl /usr/local/bin/kubectl
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Run E2E Tests
         run: |

.github/workflows/e2e_scheduling_basic.yaml

@@ -7,14 +7,17 @@ on:
     tags:
   pull_request:
 
+permissions:  
+  contents: read
+
 jobs:
   e2e_scheduling_basic:
     runs-on: ubuntu-24.04
     name: E2E about Basic Scheduling
     timeout-minutes: 40
     steps:
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: 1.22.x
 
@@ -24,7 +27,7 @@ jobs:
           tar -xf musl-1.2.1.tar.gz && cd musl-1.2.1
           ./configure
           make && sudo make install
-      - uses: actions/cache@v2
+      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -34,7 +37,7 @@ jobs:
           GO111MODULE="on" go install sigs.k8s.io/[email protected]
           curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.30.1/bin/linux/amd64/kubectl && sudo install kubectl /usr/local/bin/kubectl
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Run E2E Tests
         run: |

.github/workflows/e2e_sequence.yaml

@@ -7,14 +7,17 @@ on:
     tags:
   pull_request:
 
+permissions:  
+  contents: read
+
 jobs:
   e2e_sequence:
     runs-on: ubuntu-24.04
     name: E2E about Sequence
     timeout-minutes: 40
     steps:
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: 1.22.x
 
@@ -24,7 +27,7 @@ jobs:
           tar -xf musl-1.2.1.tar.gz && cd musl-1.2.1
           ./configure
           make && sudo make install
-      - uses: actions/cache@v2
+      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -34,7 +37,7 @@ jobs:
           GO111MODULE="on" go install sigs.k8s.io/[email protected]
           curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.30.1/bin/linux/amd64/kubectl && sudo install kubectl /usr/local/bin/kubectl
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Run E2E Tests
         run: |

.github/workflows/e2e_spark.yaml

@@ -7,6 +7,9 @@ on:
       - master
   # PR triggered job
   pull_request:
+permissions:  
+  contents: read
+
 jobs:
   k8s-integration-tests:
     name: "E2E about Spark Integration test"
@@ -15,17 +18,17 @@ jobs:
 
     - name: Checkout current Volcano repository
       if: github.event.inputs.volcano-branch==''
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
     - name: Checkout Spark repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         fetch-depth: 0
         repository: apache/spark
         ref: branch-3.4
         path: ${{ github.workspace }}/spark
     - name: Cache Scala, SBT and Maven
-      uses: actions/cache@v3
+      uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
       with:
         path: |
           build/apache-maven-*
@@ -36,24 +39,24 @@ jobs:
         restore-keys: |
           build-
     - name: Cache Coursier local repository
-      uses: actions/cache@v3
+      uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
       with:
         path: ~/.cache/coursier
         key: k8s-integration-coursier-${{ hashFiles('**/pom.xml', '**/plugins.sbt') }}
         restore-keys: |
           k8s-integration-coursier-
     - name: Install Java 8
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
       with:
         distribution: temurin
         java-version: 8
     - name: Install Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: 1.22.x
     - name: Set up Docker Buildx
       id: buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
     - name: start minikube
       run: |
         # Use pre-install minikube
@@ -87,7 +90,7 @@ jobs:
         kubectl describe node
     - name: Upload Spark on K8S integration tests log files
       if: failure()
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
       with:
         name: spark-on-kubernetes-it-log
         path: |

.github/workflows/e2e_vcctl.yaml

@@ -7,14 +7,17 @@ on:
     tags:
   pull_request:
 
+permissions:  
+  contents: read
+
 jobs:
   e2e_vcctl:
     runs-on: ubuntu-24.04
     name: E2E about Volcano CLI
     timeout-minutes: 20
     steps:
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: 1.22.x
 
@@ -24,7 +27,7 @@ jobs:
           tar -xf musl-1.2.1.tar.gz && cd musl-1.2.1
           ./configure
           make && sudo make install
-      - uses: actions/cache@v2
+      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -34,7 +37,7 @@ jobs:
           GO111MODULE="on" go install sigs.k8s.io/[email protected]
           curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.30.1/bin/linux/amd64/kubectl && sudo install kubectl /usr/local/bin/kubectl
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Run E2E Tests
         run: |

.github/workflows/fossa.yml

@@ -5,12 +5,15 @@ on:
   pull_request:
     branches: [master]
 
+permissions:  
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: 1.22.x
       - run: go version

.github/workflows/licenses_lint.yaml

@@ -7,18 +7,21 @@ on:
     tags:
   pull_request:
 
+permissions:  
+  contents: read
+
 jobs:
   licenses-lint:
     name: Licenses Lint
     timeout-minutes: 40
     runs-on: ubuntu-22.04
     steps:
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: 1.21.x
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: generate license mirror
         run: |
           make licenses-check