From e2dbf9aa29bc60cb412584d3e2031f051965232a Mon Sep 17 00:00:00 2001
From: Renaud Calle <renaud.calle@outscale.com>
Date: Mon, 13 Jul 2026 09:53:43 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=91=B7=20ci:=20add=20compliance=20wor?=
 =?UTF-8?q?kflow=20and=20remove=20obsolete?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/compliance.yml         | 22 ++++++++++++++++++++++
 .github/workflows/cred-scan.yml          | 15 ---------------
 .github/workflows/github-sanity-scan.yml | 15 ---------------
 3 files changed, 22 insertions(+), 30 deletions(-)
 create mode 100644 .github/workflows/compliance.yml
 delete mode 100644 .github/workflows/cred-scan.yml
 delete mode 100644 .github/workflows/github-sanity-scan.yml

diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
new file mode 100644
index 0000000..7d8b225
--- /dev/null
+++ b/.github/workflows/compliance.yml
@@ -0,0 +1,22 @@
+name: Compliance
+
+on:
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+jobs:
+  compliance:
+    runs-on: ubuntu-latest
+    steps:
+    - name: ⬇️ Checkout
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - name: Plumber
+      uses: outscale/.github/pipeline-compliance@2cbbe00ba9835f42809be7511fe7dba5a0dc0c15 # v1.0.0
+      with:
+        plumber-threshold: 100
+        github-token: ${{ secrets.PLUMBER_TOKEN }}
diff --git a/.github/workflows/cred-scan.yml b/.github/workflows/cred-scan.yml
deleted file mode 100644
index 06788f2..0000000
--- a/.github/workflows/cred-scan.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Credential Scanner
-
-on:
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  cred-scan:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-    - name: Scan credentials
-      uses: outscale/cred-scan@36ef82cc690d72a17bf0993ab323961f1b1f9c66 # main
-      with:
-        scan_path: "./"
\ No newline at end of file
diff --git a/.github/workflows/github-sanity-scan.yml b/.github/workflows/github-sanity-scan.yml
deleted file mode 100644
index 334c64c..0000000
--- a/.github/workflows/github-sanity-scan.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Github sanity scanner
-
-on:
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  github-sanity-scan:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-    - name: Github sanity scanner
-      uses: outscale/github-sanity-scan@380a9927b4be45d9c4f6f66a4e8dfd7cf7b18513 # main
-      with:
-        no-pull-request-target: true
\ No newline at end of file

From 0f2745c45215f517792e130f8998ac58e0403562 Mon Sep 17 00:00:00 2001
From: Renaud Calle <renaud.calle@outscale.com>
Date: Mon, 13 Jul 2026 09:54:10 +0000
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=91=B7=20ci:=20add=20permissions=20se?=
 =?UTF-8?q?ction=20to=20workflows?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/publish.yml | 4 ++++
 .github/workflows/test.yml    | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 803e11a..1a05a70 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,10 @@ on:
       - "v*"
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-and-publish:
     name: Build and Publish
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a0a0674..242b5f7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest