fix(ci): apply lessons learned to monthly roadmap reminder cross-repo (…

…#4078)

* fix(parameters): make cache aware of single vs multiple calls

Signed-off-by: heitorlessa <[email protected]>

* chore: cleanup, add test for single and nested

Signed-off-by: heitorlessa <[email protected]>

* chore: first experiment with central but private workflow

* chore: test workflow

* chore(ci): test with branch over sha as it was not found

* chore(ci): use secrets for new workflow_call

* chore(ci): update named secret input

* chore(ci): apply least-privilege permissions at job level

* chore(ci): make monthly roadmap reminder workflow immutable for sec

* chore(ci): add note about cronjob

* chore: add powertools actions to allow list until releases are done

Signed-off-by: heitorlessa <[email protected]>

---------

Signed-off-by: heitorlessa <[email protected]>
Signed-off-by: Heitor Lessa <[email protected]>

.github/workflows/on_schedule_monthly_roadmap_reminder.yml

@@ -2,17 +2,21 @@ name: Monthly roadmap reminder
 
 on:
     workflow_dispatch: {}
-#   schedule:
-#     - cron: '0 0 1 * *'
+    schedule:
+      - cron: '0 0 1 * *'  # runs first day of the month
 
 permissions:
     contents: read
-    pull-requests: read
-    issues: read
 
 
 jobs:
     call-workflow-passing-data:
-        uses: aws-powertools/actions/.github/workflows/monthly_roadmap_reminder.yml@fd4575466e5c2ac10703ac16f5aa9fb8890f532a
-        with:
-            token: ${{ github.token }}
+        permissions:
+            contents: read
+            pull-requests: read
+            issues: write  # create monthly roadmap report
+
+        # setting to `@main` until we have releases and governance installed
+        uses: aws-powertools/actions/.github/workflows/monthly_roadmap_reminder.yml@main
+        secrets:
+            token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/secure_workflows.yml

@@ -34,4 +34,6 @@ jobs:
       - name: Ensure 3rd party workflows have SHA pinned
         uses: zgosalvez/github-actions-ensure-sha-pinned-actions@19ebcb0babbd282ae1822a0b9c28f3f1f25cea45 # v3.0.4
         with:
-          allowlist: slsa-framework/slsa-github-generator
+          allowlist: |
+            slsa-framework/slsa-github-generator
+            aws-powertools/actions