patch: lots of backports to 6/edge

.github/dependabot.yaml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "06:00"
+    groups:
+      all-non-major:
+        update-types:
+          - "minor"
+          - "patch"
+    cooldown:
+      default-days: 7

.github/workflows/automatic-doc-checks.yml

@@ -3,15 +3,14 @@ name: Automatic doc checks
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
     paths:
-      - 'docs/**'   # Only run on changes to the docs directory
+      - "docs/**" # Only run on changes to the docs directory
 
   workflow_dispatch:
     # Manual trigger
 
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -22,3 +21,5 @@ jobs:
     with:
       working-directory: "docs"
       fetch-depth: 0
+    permissions:
+      contents: read

.github/workflows/bump_dependent_charms.yaml

@@ -11,6 +11,11 @@ on:
         description: "Target branch to create PR against (e.g. 6/edge)"
         required: true
         type: string
+    secrets:
+      PAT:
+        required: True
+      CI_COMMITS_SSH_SIGNING_KEY:
+        required: True
   workflow_dispatch:
     inputs:
       version:
@@ -47,10 +52,11 @@ jobs:
 
     steps:
       - name: Checkout mongo-single-kernel repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 20
           fetch-tags: true
+          persist-credentials: false
 
       - name: Get new tag content
         id: get-tag
@@ -76,11 +82,12 @@ jobs:
           echo "REVIEWERS=${REVIEWERS}" >> "$GITHUB_OUTPUT"
 
       - name: Checkout target repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ matrix.repo }}
           ref: ${{ env.BASE_BRANCH }}
           token: ${{ secrets.PAT }}
+          persist-credentials: false
 
       - name: Install tox & poetry
         run: |
@@ -89,7 +96,7 @@ jobs:
           pipx install tox poetry
 
       - name: Setup python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.10"
           cache: "poetry"
@@ -154,17 +161,19 @@ jobs:
       - name: Open Pull Request
         env:
           GITHUB_TOKEN: ${{ secrets.PAT }}
+          STEPS_GET_TAG_OUTPUTS_VERSION_CONTENT: ${{ steps.get-tag.outputs.VERSION_CONTENT }}
+          STEPS_GET_REVIEWERS_OUTPUTS_REVIEWERS: ${{ steps.get-reviewers.outputs.REVIEWERS }}
         run: |
           BODY="Automated bump of \`${DEP_NAME}\` to version \`${VERSION}\` after PyPI release.
             ### What's Changed
-            ${{ steps.get-tag.outputs.VERSION_CONTENT }}"
+            ${STEPS_GET_TAG_OUTPUTS_VERSION_CONTENT}"
 
           PR_URL=$(gh pr create \
             --title "patch: Bump ${DEP_NAME} to ${VERSION}" \
             --body "${BODY}" \
-            --base ${{ env.BASE_BRANCH }}  \
+            --base "${BASE_BRANCH}"  \
             --head "${PR_BRANCH}" \
-            --reviewer "${{ steps.get-reviewers.outputs.REVIEWERS }}"
+            --reviewer "${STEPS_GET_REVIEWERS_OUTPUTS_REVIEWERS}"
           )
           # shellcheck disable=SC2086
           echo "- ${{ matrix.repo }}: ${PR_URL}" >> $GITHUB_STEP_SUMMARY

.github/workflows/check_pr.yaml

@@ -13,4 +13,6 @@ on:
 jobs:
   check-pr:
     name: Check pull request
-    uses: canonical/data-platform-workflows/.github/workflows/check_python_package_pr.yaml@v31.1.1
+    uses: canonical/data-platform-workflows/.github/workflows/check_python_package_pr.yaml@v50.2.1
+    permissions:
+      contents: read

.github/workflows/ci-quick.yaml

@@ -1,7 +1,6 @@
 name: Run tests
 
 on:
-  pull_request:
   schedule:
     - cron: "53 0 * * *" # Daily at 00:53 UTC
   workflow_dispatch:
@@ -14,14 +13,14 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Install tox & poetry
         run: |
           pipx install tox poetry
       - name: Set up python environment
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.10"
           cache: "poetry"
@@ -32,14 +31,16 @@ jobs:
       - name: Run pre-commit hooks
         run: |
           poetry run pre-commit run --all-files
+    permissions:
+      contents: read
 
   check-pyproject-dynamic-versioning:
     name: Poetry dynamic versioning check
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Install deps
@@ -56,14 +57,18 @@ jobs:
           then
             exit 1
           fi
+    permissions:
+      contents: read
 
   actionlint:
     name: Lint .github/workflows/
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install actionlint
         id: install
         run: |
@@ -72,17 +77,28 @@ jobs:
           bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
       - name: Run actionlint
         run: |
-          '${{ steps.install.outputs.executable }}' -color
+          "$EXECUTABLE" -color
+        env:
+          EXECUTABLE: ${{ steps.install.outputs.executable }}
+    permissions:
+      contents: read
+
+  lint-workflows:
+    name: Lint .github/workflows/
+    uses: canonical/data-platform-workflows/.github/workflows/lint_workflows.yaml@v50.2.1
+    permissions:
+      contents: read
 
   lib-check:
     name: Check libraries
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Check libs
         uses: canonical/charming-actions/check-libraries@2.7.0
         with:
@@ -91,24 +107,29 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
     permissions:
       pull-requests: write
+      contents: read
 
   tox-lint:
     name: tox run -e lint
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Install tox & poetry
         run: |
           pipx install tox poetry
       - name: Set up python environment
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.10"
           cache: "poetry"
       - name: Run linters
         run: tox run -e lint
+    permissions:
+      contents: read
 
   unit-test:
     strategy:
@@ -121,16 +142,18 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Install tox & poetry
         run: |
           pipx install tox poetry
       - name: Set up python environment
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.10"
           cache: "poetry"
       - name: Run tests
         run: tox run -e unit-${{ matrix.env }}
+    permissions:
+      contents: read

.github/workflows/ci.yaml

@@ -10,12 +10,32 @@ on:
       - "docs/**"
   workflow_dispatch:
   workflow_call:
+    secrets:
+      AWS_ACCESS_KEY:
+        required: true
+      AWS_SECRET_KEY:
+        required: true
+      GCP_ACCESS_KEY:
+        required: true
+      GCP_SECRET_KEY:
+        required: true
+      GCS_SERVICE_ACCOUNT:
+        required: true
+      CHARMHUB_TOKEN:
+        required: true
 
 jobs:
+  ci-quick-tests:
+    uses: ./.github/workflows/ci-quick.yaml
+    permissions:
+      contents: read
+      pull-requests: write
+
   build:
     name: Build test charms
     runs-on: ubuntu-latest
     timeout-minutes: 120
+    needs: ci-quick-tests
     strategy:
       matrix:
         path:
@@ -25,9 +45,9 @@ jobs:
           - tests/charms/mongos_k8s_test_charm
     steps:
       - name: Install CLI
-        run: pipx install git+https://github.com/canonical/data-platform-workflows@v31.1.1#subdirectory=python/cli
+        run: pipx install git+https://github.com/canonical/data-platform-workflows@v50.2.1#subdirectory=_cli
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Install tox & poetry
@@ -51,7 +71,7 @@ jobs:
           sudo snap install charmcraft --classic
           pipx install charmcraftcache
       - name: Set up python environment
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.10"
           cache: "poetry"
@@ -66,26 +86,31 @@ jobs:
         id: path-in-artifact
         run: compute-path-in-artifact '${{ matrix.path }}'
       - name: Upload charm
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: packed-charm-${{ steps.path-in-artifact.outputs.path }}
           path: |
             ${{ matrix.path }}/*.charm
             .empty
           if-no-files-found: error
+    permissions:
+      contents: read
 
   build-helpers:
+    needs: ci-quick-tests
     strategy:
       matrix:
         path:
           - tests/integration/applications/client_relations_charm
           - tests/integration/applications/continuous_write_charm
           - tests/integration/applications/mongos_client_charm
     name: Build charm | ${{ matrix.path }}
-    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v30.2.0
+    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v50.2.1
     with:
       path-to-charm-directory: ${{ matrix.path }}
       cache: true
+    permissions:
+      contents: read
 
   integration-test:
     name: Integration test charm
@@ -95,6 +120,11 @@ jobs:
     uses: ./.github/workflows/integration_test.yaml
     with:
       artifact-prefix: packed-charm
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
+      AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
+      GCP_ACCESS_KEY: ${{ secrets.GCP_ACCESS_KEY }}
+      GCP_SECRET_KEY: ${{ secrets.GCP_SECRET_KEY }}
+      GCS_SERVICE_ACCOUNT: ${{ secrets.GCS_SERVICE_ACCOUNT }}
     permissions:
       contents: write # Needed for Allure Report

.github/workflows/cla.yaml

@@ -7,3 +7,5 @@ jobs:
     steps:
       - name: Check if CLA signed
         uses: canonical/has-signed-canonical-cla@v2
+    permissions:
+      contents: read