Update fork base to v0.7.8 to add RateLimitLinearJitterBackoff

[liorschach]

Summary

• Updates the fork base from v0.7.8 (upstream) to include RateLimitLinearJitterBackoff function
• Cherry-picks all existing wiz-specific changes on top of v0.7.8

Motivation

vault/api@v1.22.0 (pulled transitively by sigstore/fulcio@v1.8.3) requires RateLimitLinearJitterBackoff from go-retryablehttp v0.7.8. This function was missing in our fork based on v0.7.7, causing build failures when using go.work:

../../../go/pkg/mod/github.com/hashicorp/vault/api@v1.22.0/client.go:264:31: undefined: retryablehttp.RateLimitLinearJitterBackoff

Changes

Rebased wiz-specific commits onto upstream v0.7.8:

• WZ-42693 - Add last status code to error message
• WZ-42693 - Use retry after only if lower than max
• Don't wait if needed to wait more than max time
• PRSEC-2439 - Remove URL query when logging

What we did?

  # Add upstream remote (hashicorp's original repo)
  git remote add upstream https://github.com/hashicorp/go-retryablehttp.git

  # Fetch upstream tags
  git fetch upstream --tags

  # Create new branch from v0.7.8
  git checkout -b liroschach/WZ-64179/udpate-v0.7.8 v0.7.8

  # Cherry-pick wiz-specific commits (in order)
  git cherry-pick e6acd96  # WZ-42693 - Add last status code to error message
  git cherry-pick ad73a27  # WZ-42693 - Use retry after only if lower than max
  git cherry-pick 95c4cad  # Don't wait if needed to wait more than max time
  git cherry-pick b7c5303  # PRSEC-2439 - Remove URL query when logging

  # Verify build and tests
  go build ./...
  go test ./...

After Merge

Tag as v0.7.8-wiz-1 and update replace directives in the monorepo.

To fix the problem, the workflow should explicitly declare least-privilege GITHUB_TOKEN permissions. Since this job only checks out code, runs Go tooling, and uploads artifacts, it needs only read access to repository contents, and does not need write access to any scopes.

The best fix with no functional change is to add a permissions block with contents: read. This can be done at the workflow root (applies to all jobs) or for the specific job. Here, we will add it at the root level right after the name line to clearly restrict permissions for the entire workflow. Concretely, in .github/workflows/pr-unit-tests.yaml, insert:

permissions:
  contents: read

between the existing name: Unit tests and the on: block. No imports or additional methods are required; this is purely a YAML configuration change.