Updated reusable caller permissions/secrets and hardened Taskfile sync/version validation

Author: ChristophShyper

.github/workflows/auto-create-pull-request.yml

@@ -17,5 +17,4 @@ jobs:
     uses: devops-infra/.github/.github/workflows/reusable-auto-create-pull-request.yml@v1
     with:
       profile: actions
-    secrets:
-      DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+    secrets: inherit

.github/workflows/cron-check-dependencies.yml

@@ -9,11 +9,11 @@ permissions:
   contents: read
   issues: write
   pull-requests: read
+  packages: write
 
 jobs:
   call:
     uses: devops-infra/.github/.github/workflows/reusable-cron-check-dependencies.yml@v1
     with:
       profile: actions
-    secrets:
-      DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+    secrets: inherit

.github/workflows/manual-sync-common-files.yml

@@ -24,3 +24,4 @@ jobs:
     with:
       sync-type: ${{ inputs.type }}
       template-profile: actions
+    secrets: inherit

.github/workflows/manual-update-version.yml

@@ -26,6 +26,7 @@ on:
 permissions:
   contents: write
   packages: write
+  pull-requests: write
 
 jobs:
   call:
@@ -35,5 +36,4 @@ jobs:
       explicit-version: ${{ inputs.version }}
       build-and-push-only: ${{ inputs.build_only }}
       profile: actions
-    secrets:
-      DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+    secrets: inherit

Taskfile.cicd.yml

@@ -103,6 +103,10 @@ tasks:
           echo "❌ ERROR: VERSION is empty"
           exit 1
         fi
+        if ! echo "{{.VERSION}}" | grep -Eq '^v?[0-9]+\.[0-9]+\.[0-9]+$'; then
+          echo "❌ ERROR: VERSION '{{.VERSION}}' is not a valid semantic version (expected vX.Y.Z or X.Y.Z)"
+          exit 1
+        fi
       - echo Updating full version from {{.VERSION_FROM_ACTION_YML}} to {{.VERSION}}
       - echo Updating minor version from {{.MINOR_FROM_ACTION_YML}} to {{.VERSION_MINOR}}
       - echo Updating major version from {{.MAJOR_FROM_ACTION_YML}} to {{.VERSION_MAJOR}}
@@ -159,7 +163,9 @@ tasks:
             [ -n "$current" ] || { echo "Current version not found or invalid. Expected vX.Y.Z"; exit 1; }
             current="$(normalize_version "$current")" || { echo "Current version not found or invalid. Expected vX.Y.Z"; exit 1; }
             no_v="${current#v}"
-            IFS='.' read -r major minor patch <<< "$no_v"
+            major="$(printf "%s" "$no_v" | awk -F. '{print $1}')"
+            minor="$(printf "%s" "$no_v" | awk -F. '{print $2}')"
+            patch="$(printf "%s" "$no_v" | awk -F. '{print $3}')"
             case "$bump_type" in
               patch) next="v${major}.${minor}.$((patch + 1))" ;;
               minor) next="v${major}.$((minor + 1)).0" ;;
@@ -270,11 +276,11 @@ tasks:
     cmds:
       - |
         echo "▶️ Syncing configuration files from devops-infra/.github..."
-        curl -sL {{.CONFIGS_BASE_URL}}/.editorconfig -o ./.editorconfig
-        curl -sL {{.CONFIGS_BASE_URL}}/.hadolint.yaml -o ./.hadolint.yaml
-        curl -sL {{.CONFIGS_BASE_URL}}/.pre-commit-config.yaml -o ./.pre-commit-config.yaml
-        curl -sL {{.CONFIGS_BASE_URL}}/.shellcheckrc -o ./.shellcheckrc
-        curl -sL {{.CONFIGS_BASE_URL}}/.yamllint.yml -o ./.yamllint.yml
+        curl -fsSL {{.CONFIGS_BASE_URL}}/.editorconfig -o ./.editorconfig
+        curl -fsSL {{.CONFIGS_BASE_URL}}/.hadolint.yaml -o ./.hadolint.yaml
+        curl -fsSL {{.CONFIGS_BASE_URL}}/.pre-commit-config.yaml -o ./.pre-commit-config.yaml
+        curl -fsSL {{.CONFIGS_BASE_URL}}/.shellcheckrc -o ./.shellcheckrc
+        curl -fsSL {{.CONFIGS_BASE_URL}}/.yamllint.yml -o ./.yamllint.yml
         git add .editorconfig .hadolint.yaml .pre-commit-config.yaml .shellcheckrc .yamllint.yml
         echo "✅ Synced configuration files"
 
@@ -283,8 +289,8 @@ tasks:
     cmds:
       - |
         echo "▶️ Syncing ignore files from devops-infra/.github..."
-        curl -sL {{.CONFIGS_BASE_URL}}/.gitignore -o ./.gitignore
-        curl -sL {{.CONFIGS_BASE_URL}}/.dockerignore -o ./.dockerignore
+        curl -fsSL {{.CONFIGS_BASE_URL}}/.gitignore -o ./.gitignore
+        curl -fsSL {{.CONFIGS_BASE_URL}}/.dockerignore -o ./.dockerignore
         git add .gitignore .dockerignore
         echo "✅ Synced ignore files"
 
@@ -293,9 +299,9 @@ tasks:
     cmds:
       - |
         echo "▶️ Syncing Taskfiles from devops-infra/.github..."
-        curl -sL {{.TASKFILES_BASE_URL}}/Taskfile.yml -o ./Taskfile.yml
-        curl -sL {{.TASKFILES_BASE_URL}}/Taskfile.cicd.yml -o ./Taskfile.cicd.yml
-        curl -sL {{.TASKFILES_BASE_URL}}/Taskfile.docker.yml -o ./Taskfile.docker.yml
-        curl -sL {{.TASKFILES_BASE_URL}}/Taskfile.variables.yml -o ./Taskfile.variables.yml
+        curl -fsSL {{.TASKFILES_BASE_URL}}/Taskfile.yml -o ./Taskfile.yml
+        curl -fsSL {{.TASKFILES_BASE_URL}}/Taskfile.cicd.yml -o ./Taskfile.cicd.yml
+        curl -fsSL {{.TASKFILES_BASE_URL}}/Taskfile.docker.yml -o ./Taskfile.docker.yml
+        curl -fsSL {{.TASKFILES_BASE_URL}}/Taskfile.variables.yml -o ./Taskfile.variables.yml
         git add Taskfile*.yml
         echo "✅ Synced Taskfiles"