new(ci): add dependabot for github actons.

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      actions:
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/ansible-lint.yml

@@ -8,11 +8,12 @@ jobs:
     name: Ansible Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: Run ansible-lint
-        uses: ansible/ansible-lint[email protected] # the latest version has a bug that does not run in online mode
+        uses: ansible/ansible-lint@44be233dbd6a8a6d8f3c5297c318ed4ed4644c32 # v24.10.0
         with:
-          path: "ansible-playbooks/" 
+          working_directory: "${{ github.workspace }}/ansible-playbooks"
+          requirements_file: "${{ github.workspace }}/requirements.yml"

.github/workflows/reusable_build_images.yml

@@ -25,14 +25,14 @@ jobs:
       fail-fast: false
       matrix:
         arch: [amd64, arm64]
-    runs-on: ${{ (matrix.arch == 'arm64' && 'actuated-arm64-8cpu-16gb') || 'ubuntu-22.04' }}
+    runs-on: ${{ (matrix.arch == 'arm64' && 'oracle-aarch64-4cpu-16gb') || 'ubuntu-22.04' }}
     steps:  
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Login to Github Packages
         if: inputs.push
-        uses: docker/login-action@v1
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

ansible-playbooks/roles/scap_open/tasks/main.yml

@@ -24,15 +24,15 @@
   rescue:
     - name: Disable Modern Bpf support
       ansible.builtin.set_fact:
-        modern_bpf_supported: false
+        scap_open_modern_bpf_supported: false
       when: result.rc == 95
 
 - name: Check Old Bpf Support
   block:
     - name: Enable old Bpf support
       ansible.builtin.set_fact:
-        bpf_supported: true
-      when: ansible_kernel is version(bpf_minimum_kver[ansible_architecture],'>=')
+        scap_open_bpf_supported: true
+      when: ansible_kernel is version(scap_open_bpf_minimum_kver[ansible_architecture],'>=')
 
 - name: Prepare the build directory
   block:
@@ -50,7 +50,7 @@
              -DUSE_BUNDLED_DEPS=ON
              -DBUILD_LIBSCAP_MODERN_BPF=OFF
              -DBUILD_LIBSCAP_GVISOR=OFF
-             -DBUILD_BPF={{ bpf_supported }}
+             -DBUILD_BPF={{ scap_open_bpf_supported }}
              -DCREATE_TEST_TARGETS=OFF
              ..
         chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build"
@@ -139,7 +139,7 @@
         cmd: make bpf -j {{ cpus }}
         chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build"
       register: bpf_probe_result
-      when: bpf_supported
+      when: scap_open_bpf_supported
       changed_when: false
   rescue:
     - name: Print error message to stdout --- build bpf probe
@@ -161,7 +161,7 @@
         cmd: /tmp/scap-open --num_events 50 --bpf driver/bpf/probe.o
         chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build"
       register: result
-      when: bpf_supported
+      when: scap_open_bpf_supported
       changed_when: false
   rescue:
     - name: Print error message to stdout --- scap-open + bpf probe
@@ -183,7 +183,7 @@
         cmd: /tmp/scap-open --num_events 50 --modern_bpf
         chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build"
       register: result
-      when: modern_bpf_supported
+      when: scap_open_modern_bpf_supported
       changed_when: false
   rescue:
     - name: Print error message to stdout --- scap-open + modern probe

ansible-playbooks/roles/scap_open/vars/main.yml

@@ -1,6 +1,6 @@
 ---
-modern_bpf_supported: true
-bpf_supported: false
-bpf_minimum_kver:
+scap_open_modern_bpf_supported: true
+scap_open_bpf_supported: false
+scap_open_bpf_minimum_kver:
   aarch64: '4.17'
   x86_64: '4.14'

requirements.yml

@@ -2,3 +2,4 @@
 collections:
   - name: community.docker
   - name: community.crypto
+  - name: ansible.posix