Fix workflow YAML formatting and permissions

Reformat the 00-pr-scanner workflow for consistent indentation. Add
artifact-metadata: read to pr-scanner permissions, include GO111MODULE
in the pr-scanner inputs, and set fetch-depth/submodules on the
actions/checkout step

.github/workflows/00-pr-scanner.yaml

@@ -1,188 +1,189 @@
 name: 00-pr_scanner
 permissions: read-all
 on:
-  workflow_dispatch: {}
-  pull_request:
-    types: [opened, reopened, synchronize, ready_for_review]
-    paths-ignore:
-      - "**.yaml"
-      - "**.yml"
-      - "**.md"
-      - "**.sh"
-      - "website/*"
-      - "examples/*"
-      - "docs/*"
-      - "build/*"
-      - ".github/*"
+    workflow_dispatch: {}
+    pull_request:
+        types: [opened, reopened, synchronize, ready_for_review]
+        paths-ignore:
+            - "**.yaml"
+            - "**.yml"
+            - "**.md"
+            - "**.sh"
+            - "website/*"
+            - "examples/*"
+            - "docs/*"
+            - "build/*"
+            - ".github/*"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
 
 jobs:
-  pr-scanner:
-    permissions:
-      actions: read
-      attestations: read
-      checks: read
-      contents: write
-      deployments: read
-      discussions: read
-      id-token: write
-      issues: read
-      models: read
-      packages: read
-      pages: read
-      pull-requests: write
-      repository-projects: read
-      security-events: read
-      statuses: read
-    uses: ./.github/workflows/a-pr-scanner.yaml
-    with:
-      RELEASE: ""
-      CLIENT: test
-      CGO_ENABLED: 0
-      GO111MODULE: ""
-    secrets: inherit
-
-  wf-preparation:
-    name: secret-validator
-    runs-on: ubuntu-latest
-    outputs:
-      TEST_NAMES: ${{ steps.export_tests_to_env.outputs.TEST_NAMES }}
-      is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}
-
-    steps:
-      - name: check if the necessary secrets are set in github secrets
-        id: check-secret-set
-        env:
-          CUSTOMER: ${{ secrets.CUSTOMER }}
-          USERNAME: ${{ secrets.USERNAME }}
-          PASSWORD: ${{ secrets.PASSWORD }}
-          CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
-          SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: "echo \"is-secret-set=${{ env.CUSTOMER != '' && env.USERNAME != '' && env.PASSWORD != '' && env.CLIENT_ID != '' && env.SECRET_KEY != '' && env.REGISTRY_USERNAME != '' && env.REGISTRY_PASSWORD != '' }}\" >> $GITHUB_OUTPUT\n"
-
-      - id: export_tests_to_env
-        name: set test name
-        run: |
-          echo "TEST_NAMES=$input" >> $GITHUB_OUTPUT
-        env:
-          input: '[
-            "scan_nsa",
-            "scan_mitre",
-            "scan_with_exceptions",
-            "scan_repository",
-            "scan_local_file",
-            "scan_local_glob_files",
-            "scan_local_list_of_files",
-            "scan_git_repository_and_submit_to_backend",
-            "scan_and_submit_to_backend",
-            "scan_customer_configuration",
-            "scan_compliance_score",
-            "scan_custom_framework_scanning_file_scope_testing",
-            "scan_custom_framework_scanning_cluster_scope_testing",
-            "scan_custom_framework_scanning_cluster_and_file_scope_testing"
-            ]'
-
-  run-system-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        TEST: ${{ fromJson(needs.wf-preparation.outputs.TEST_NAMES) }}
-    needs: [wf-preparation, pr-scanner]
-    if: ${{ (needs.wf-preparation.outputs.is-secret-set == 'true') && (always() && (contains(needs.*.result, 'success') || contains(needs.*.result, 'skipped')) && !(contains(needs.*.result, 'failure')) && !(contains(needs.*.result, 'cancelled'))) }}
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v4
+    pr-scanner:
+        permissions:
+            actions: read
+            attestations: read
+            checks: read
+            contents: write
+            deployments: read
+            discussions: read
+            id-token: write
+            issues: read
+            models: read
+            packages: read
+            pages: read
+            pull-requests: write
+            repository-projects: read
+            security-events: read
+            statuses: read
+            artifact-metadata: read
+        uses: ./.github/workflows/a-pr-scanner.yaml
         with:
-          fetch-depth: 0
-          submodules: recursive
+            RELEASE: ""
+            CLIENT: test
+            CGO_ENABLED: 0
+            GO111MODULE: ""
+        secrets: inherit
 
-      - uses: actions/setup-go@v4
-        name: Installing go
-        with:
-          go-version: "1.25"
+    wf-preparation:
+        name: secret-validator
+        runs-on: ubuntu-latest
+        outputs:
+            TEST_NAMES: ${{ steps.export_tests_to_env.outputs.TEST_NAMES }}
+            is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}
 
-      - uses: anchore/sbom-action/download-syft@v0
-        name: Setup Syft
+        steps:
+            - name: check if the necessary secrets are set in github secrets
+              id: check-secret-set
+              env:
+                  CUSTOMER: ${{ secrets.CUSTOMER }}
+                  USERNAME: ${{ secrets.USERNAME }}
+                  PASSWORD: ${{ secrets.PASSWORD }}
+                  CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
+                  SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
+                  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+                  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+              run: "echo \"is-secret-set=${{ env.CUSTOMER != '' && env.USERNAME != '' && env.PASSWORD != '' && env.CLIENT_ID != '' && env.SECRET_KEY != '' && env.REGISTRY_USERNAME != '' && env.REGISTRY_PASSWORD != '' }}\" >> $GITHUB_OUTPUT\n"
 
-      - uses: goreleaser/goreleaser-action@v6
-        name: Build
-        with:
-          distribution: goreleaser
-          version: latest
-          args: build --clean --snapshot --single-target
-        env:
-          RELEASE: ""
-          CLIENT: test
-          CGO_ENABLED: 0
+            - id: export_tests_to_env
+              name: set test name
+              run: |
+                  echo "TEST_NAMES=$input" >> $GITHUB_OUTPUT
+              env:
+                  input: '[
+                      "scan_nsa",
+                      "scan_mitre",
+                      "scan_with_exceptions",
+                      "scan_repository",
+                      "scan_local_file",
+                      "scan_local_glob_files",
+                      "scan_local_list_of_files",
+                      "scan_git_repository_and_submit_to_backend",
+                      "scan_and_submit_to_backend",
+                      "scan_customer_configuration",
+                      "scan_compliance_score",
+                      "scan_custom_framework_scanning_file_scope_testing",
+                      "scan_custom_framework_scanning_cluster_scope_testing",
+                      "scan_custom_framework_scanning_cluster_and_file_scope_testing"
+                      ]'
 
-      - name: chmod +x
-        run: chmod +x -R ${PWD}/dist/cli_linux_amd64_v1/kubescape
+    run-system-tests:
+        strategy:
+            fail-fast: false
+            matrix:
+                TEST: ${{ fromJson(needs.wf-preparation.outputs.TEST_NAMES) }}
+        needs: [wf-preparation, pr-scanner]
+        if: ${{ (needs.wf-preparation.outputs.is-secret-set == 'true') && (always() && (contains(needs.*.result, 'success') || contains(needs.*.result, 'skipped')) && !(contains(needs.*.result, 'failure')) && !(contains(needs.*.result, 'cancelled'))) }}
+        runs-on: ubuntu-latest
+        permissions:
+            actions: read
+            contents: read
+            pull-requests: write
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+                  submodules: recursive
 
-      - name: Checkout systests repo
-        uses: actions/checkout@v4
-        with:
-          repository: armosec/system-tests
-          path: system-tests
+            - uses: actions/setup-go@v4
+              name: Installing go
+              with:
+                  go-version: "1.25"
 
-      - uses: actions/setup-python@v4
-        with:
-          python-version: "3.9"
-          cache: "pip"
+            - uses: anchore/sbom-action/download-syft@v0
+              name: Setup Syft
 
-      - name: create env
-        run: ./create_env.sh
-        working-directory: system-tests
+            - uses: goreleaser/goreleaser-action@v6
+              name: Build
+              with:
+                  distribution: goreleaser
+                  version: latest
+                  args: build --clean --snapshot --single-target
+              env:
+                  RELEASE: ""
+                  CLIENT: test
+                  CGO_ENABLED: 0
 
-      - name: Generate uuid
-        id: uuid
-        run: |
-          echo "RANDOM_UUID=$(uuidgen)" >> $GITHUB_OUTPUT
+            - name: chmod +x
+              run: chmod +x -R ${PWD}/dist/cli_linux_amd64_v1/kubescape
 
-      - name: Create k8s Kind Cluster
-        id: kind-cluster-install
-        uses: helm/kind-action@v1.10.0
-        with:
-          cluster_name: ${{ steps.uuid.outputs.RANDOM_UUID }}
+            - name: Checkout systests repo
+              uses: actions/checkout@v4
+              with:
+                  repository: armosec/system-tests
+                  path: system-tests
 
-      - name: run-tests-on-local-built-kubescape
-        env:
-          CUSTOMER: ${{ secrets.CUSTOMER }}
-          USERNAME: ${{ secrets.USERNAME }}
-          PASSWORD: ${{ secrets.PASSWORD }}
-          CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
-          SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        working-directory: system-tests
-        run: |
-          echo "Test history:"
-          echo " ${{ matrix.TEST }} " >/tmp/testhistory
-          cat /tmp/testhistory
-          source systests_python_env/bin/activate
+            - uses: actions/setup-python@v4
+              with:
+                  python-version: "3.9"
+                  cache: "pip"
 
-          python3 systest-cli.py             \
-            -t ${{ matrix.TEST }}            \
-            -b production                    \
-            -c CyberArmorTests               \
-            --duration 3                     \
-            --logger DEBUG                   \
-            --kwargs kubescape=${GITHUB_WORKSPACE}/dist/cli_linux_amd64_v1/kubescape
+            - name: create env
+              run: ./create_env.sh
+              working-directory: system-tests
 
-          deactivate
+            - name: Generate uuid
+              id: uuid
+              run: |
+                  echo "RANDOM_UUID=$(uuidgen)" >> $GITHUB_OUTPUT
 
-      - name: Test Report
-        uses: mikepenz/action-junit-report@v5
-        if: always()
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          report_paths: "system-tests/**/results_xml_format/**.xml"
-          commit: ${{github.event.workflow_run.head_sha}}
+            - name: Create k8s Kind Cluster
+              id: kind-cluster-install
+              uses: helm/kind-action@v1.10.0
+              with:
+                  cluster_name: ${{ steps.uuid.outputs.RANDOM_UUID }}
+
+            - name: run-tests-on-local-built-kubescape
+              env:
+                  CUSTOMER: ${{ secrets.CUSTOMER }}
+                  USERNAME: ${{ secrets.USERNAME }}
+                  PASSWORD: ${{ secrets.PASSWORD }}
+                  CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
+                  SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
+                  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+                  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+              working-directory: system-tests
+              run: |
+                  echo "Test history:"
+                  echo " ${{ matrix.TEST }} " >/tmp/testhistory
+                  cat /tmp/testhistory
+                  source systests_python_env/bin/activate
+
+                  python3 systest-cli.py             \
+                    -t ${{ matrix.TEST }}            \
+                    -b production                    \
+                    -c CyberArmorTests               \
+                    --duration 3                     \
+                    --logger DEBUG                   \
+                    --kwargs kubescape=${GITHUB_WORKSPACE}/dist/cli_linux_amd64_v1/kubescape
+
+                  deactivate
+
+            - name: Test Report
+              uses: mikepenz/action-junit-report@v5
+              if: always()
+              with:
+                  github_token: ${{ secrets.GITHUB_TOKEN }}
+                  report_paths: "system-tests/**/results_xml_format/**.xml"
+                  commit: ${{github.event.workflow_run.head_sha}}