Signed-off-by: Tamal Saha <tamal@appscode.com>

Signed-off-by: Tamal Saha <tamal@appscode.com>

Signed-off-by: sami <sami@appscode.com>

* Use dynamic github token

Signed-off-by: Tamal Saha <tamal@appscode.com>

* Harden GitHub Actions workflows

- Pin every action ref to a full-length commit SHA with a trailing
  version comment, so floating tags like @v4 can't be re-pointed at
  malicious code.
- Bump outdated actions/checkout@v1 to @v4.3.1 (where present).
- Tag-triggered workflows now check out with fetch-depth: 1 and
  fetch-tags: true so the tag ref is available downstream.
- release-tracker.yml grants contents: write at the job level so the
  default GITHUB_TOKEN can push commits/tags back to the repo.

Signed-off-by: Tamal Saha <tamal@appscode.com>

* Grant preview-website job the permissions Firebase deploy needs

Signed-off-by: Tamal Saha <tamal@appscode.com>

* Use GitHub App token for release tracker comments

Signed-off-by: Tamal Saha <tamal@appscode.com>

* Apply kubedb/installer#2281: harden CI workflows

Signed-off-by: Tamal Saha <tamal@appscode.com>

* Remove Prepare git step from release-tracker.yml

Signed-off-by: Tamal Saha <tamal@appscode.com>

* Rename LGTM App token step id to lgtm-app-token

Signed-off-by: Tamal Saha <tamal@appscode.com>

* release-tracker.yml: gate at job level with merged == true

Signed-off-by: Tamal Saha <tamal@appscode.com>

* release-tracker.yml: drop permissions block

Signed-off-by: Tamal Saha <tamal@appscode.com>

* release-tracker.yml: grant permission-pull-requests to LGTM App

Signed-off-by: Tamal Saha <tamal@appscode.com>

* Use node-version: '22' in setup-node steps

Signed-off-by: Tamal Saha <tamal@appscode.com>

* Add 1gtm-app[bot] to kodiak auto_approve_usernames

Signed-off-by: Tamal Saha <tamal@appscode.com>

* Normalize kodiak auto_approve_usernames

Signed-off-by: Tamal Saha <tamal@appscode.com>

---------

Signed-off-by: Tamal Saha <tamal@appscode.com>

release-tracker.yml:
- Move the merged-PR gate from the build job to label-detector so
  non-merge closes skip the workflow entirely.
- Add explicit contents: read permissions to the build job.

release.yml:
- Drop misleading permissions from the label-detector job, which only
  runs a curl and emits a job output.
- Add packages: write to the build job alongside contents: write; the
  docker/login-action push to ghcr.io requires it.

Signed-off-by: Tamal Saha <tamal@appscode.com>

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

Signed-off-by: Tamal Saha <tamal@appscode.com>

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

…l", redundant intros/closings) from the cluster-management and database-management guide sections

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

Signed-off-by: Tamal Saha <tamal@appscode.com>
Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>
Co-authored-by: Arnob Kumar Saha <arnob@appscode.com>

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>

ProductLine: ACE
Release: v2026.6.19
Release-tracker: appscode-cloud/CHANGELOG#75
Signed-off-by: 1gtm <1gtm@appscode.com>
Signed-off-by: Tamal Saha <tamal@appscode.com>