fix: update permissions and enhance container structure testing in workflows

[github-actions]

📝 Brief description

fix: update permissions and enhance container structure testing in workflows
fix: update cron job permissions to include issue access

💻 Commits

• c31acda - ChristophShyper - 2026-04-12 20:01:05
  | fix: update cron job permissions to include issue access
  |
• 8120534 - ChristophShyper - 2026-04-12 19:40:57
  fix: update permissions and enhance container structure testing in workflows

📁 Modified files

.github/workflows/cron-check-dependencies.yml | 6 +-
.../reusable-auto-create-pull-request.yml | 39 +++++
.../workflows/reusable-cron-check-dependencies.yml | 191 +++++++++++++--------
.../reusable-manual-sync-common-files.yml | 1 +
.../workflows/reusable-manual-update-version.yml | 40 +++++
Taskfile.cicd.yml | 1 +
templates/actions/taskfiles/Taskfile.docker.yml | 5 +
.../actions/workflows/cron-check-dependencies.yml | 8 +-
templates/dockerized/taskfiles/Taskfile.docker.yml | 5 +
.../workflows/cron-check-dependencies.yml | 8 +-
.../other/workflows/cron-check-dependencies.yml | 8 +-
.../static/workflows/cron-check-dependencies.yml | 8 +-
12 files changed, 228 insertions(+), 92 deletions(-)

⚠️ Additional information

• Pushed to a branch with a proper name and provided proper commit message.
• Provided a clear and concise description of what the issue is.

Check CONTRIBUTING.md and CODE_OF_CONDUCT.md for more information

[Copilot]

Pull request overview

This PR updates GitHub Actions workflows to support automated weekly “health” updates via pull requests, and adds container-structure-test (CST) detection/execution plus some CI/CD linting improvements.

Changes:

• Broaden workflow GITHUB_TOKEN permissions to allow committing changes and creating PRs in dependency/health workflows.
• Add CST config discovery + CST execution to reusable workflows and add a Task target to output the image reference used for CST.
• Extend the CI/CD Taskfile lint pipeline to include hadolint.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
.github/workflows/cron-check-dependencies.yml	Updates permissions for the weekly health caller workflow.
.github/workflows/reusable-cron-check-dependencies.yml	Refactors weekly report generation, adds CST steps, adds stale PR detection, and switches from issue updates to PR creation.
.github/workflows/reusable-auto-create-pull-request.yml	Adds CST config detection, image resolution, and CST execution to the docker job.
.github/workflows/reusable-manual-sync-common-files.yml	Passes repo-token to Task setup.
.github/workflows/reusable-manual-update-version.yml	Passes repo-token to Task setup and adds CST steps for build-and-push-only mode.
Taskfile.cicd.yml	Adds hadolint to the lint task pipeline.
templates/actions/workflows/cron-check-dependencies.yml	Updates permissions for template weekly health workflow.
templates/dockerized/workflows/cron-check-dependencies.yml	Updates permissions for template weekly health workflow.
templates/other/workflows/cron-check-dependencies.yml	Updates permissions for template weekly health workflow.
templates/static/workflows/cron-check-dependencies.yml	Updates permissions for template weekly health workflow.
templates/actions/taskfiles/Taskfile.docker.yml	Adds docker:image:test:ref Task target for CST image resolution.
templates/dockerized/taskfiles/Taskfile.docker.yml	Adds docker:image:test:ref Task target for CST image resolution.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.