Fix overly broad permissions and template injection risks in GHA workflows

[caxu-rh]

Summary by CodeRabbit

Chores

• Enhanced security posture by implementing explicit read-only permissions across all CI/CD workflows to restrict unnecessary access.
• Improved consistency and maintainability of environment variable handling throughout build and release processes.
• Refactored workflow configuration for better clarity and streamlined execution.

[coderabbitai]

Walkthrough

This PR hardens GitHub Actions workflow security by explicitly declaring read-only contents permissions across three workflows, and refactors environment variable handling and output formatting in both build-main and build-release workflows to use consistent quoted expressions and multi-line run blocks.

Changes

GitHub Actions Workflow Security and Refactoring

Layer / File(s)	Summary
Permissions hardening across workflows .github/workflows/build-main.yml, .github/workflows/build-release.yml, .github/workflows/ci.yml	All three workflows now explicitly declare permissions: contents: read at the job or workflow level, restricting default GitHub Actions permissions to read-only repository access.
Registry and variable refactoring in main workflow .github/workflows/build-main.yml	The "Set image registry env" step refactors registry variable computation to use quoted parsing and a local _IMAGE_REGISTRY variable. The VERSION environment variable in the "Build Bundle" step is adjusted to use shell line continuation. Two separate single-line push-status echo steps are consolidated into a single multi-line run block that sources registry paths from step environment variables.
Environment tags and output refactoring in release workflow .github/workflows/build-release.yml	The "Set Env Tags" step is refactored to compute RELEASE_TAG, IMAGE_REGISTRY, and IMAGE_REPO using quoted shell expressions and write them to GITHUB_ENV. The bundle build environment is updated to set VERSION and USE_IMAGE_DIGESTS with line continuation syntax. Post-push messaging is consolidated from two echo commands into a multi-line run block that uses environment variables for operator and bundle registry paths.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main changes in the PR: adding explicit job-level permissions restrictions and fixing template injection risks across multiple GitHub Actions workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	git diff --name-only between PR and main shows only .github/workflows/build-main.yml, build-release.yml, and ci.yml changed; no Ginkgo test titles were modified.
Test Structure And Quality	✅ Passed	PR #185 modifies only .github/workflows/*.yml; no Ginkgo test code is changed, so the test-structure quality requirements are not applicable.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-main.yml:
- Around line 39-43: The workflow currently splits _IMAGE_REGISTRY with cut -d
'/' -f 1 and -f 2 which drops any nested repo path; change the parsing so
IMAGE_REGISTRY = first segment before the first '/' and IMAGE_REPO = everything
after the first '/' (i.e., take the remainder, not only the second segment) and
add validation to ensure _IMAGE_REGISTRY contains at least one '/' and non-empty
repo portion; update the commands that set IMAGE_REGISTRY/IMAGE_REPO in both
places where _IMAGE_REGISTRY is used (reference the environment var
_IMAGE_REGISTRY and outputs written to GITHUB_ENV for IMAGE_REGISTRY and
IMAGE_REPO) so nested namespaces are preserved and the workflow fails early on
invalid format.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d783aab8-c87e-4ada-bec6-dd7d14634540

📥 Commits

Reviewing files that changed from the base of the PR and between f772a25 and a8fba18.

📒 Files selected for processing (3)

• .github/workflows/build-main.yml
• .github/workflows/build-release.yml
• .github/workflows/ci.yml

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Root cause: registry parsing truncates namespace in both workflow files.

Both .github/workflows/build-main.yml and .github/workflows/build-release.yml derive IMAGE_REPO with cut -d '/' -f 2, which loses nested path segments and can push to unintended repositories. Use “first segment as registry, remainder as repo” parsing in both files, with format validation.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-main.yml around lines 39 - 43, The workflow
currently splits _IMAGE_REGISTRY with cut -d '/' -f 1 and -f 2 which drops any
nested repo path; change the parsing so IMAGE_REGISTRY = first segment before
the first '/' and IMAGE_REPO = everything after the first '/' (i.e., take the
remainder, not only the second segment) and add validation to ensure
_IMAGE_REGISTRY contains at least one '/' and non-empty repo portion; update the
commands that set IMAGE_REGISTRY/IMAGE_REPO in both places where _IMAGE_REGISTRY
is used (reference the environment var _IMAGE_REGISTRY and outputs written to
GITHUB_ENV for IMAGE_REGISTRY and IMAGE_REPO) so nested namespaces are preserved
and the workflow fails early on invalid format.