[SELC-8252] feat: Added module for container_app into Onboarding

[giampiero-ferrara]

List of Changes

Added config for container_app for onboarding
Added config for current locals for function

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.

To fix the problem, explicitly declare a minimal permissions block so this workflow does not rely on repository/organization defaults. Since the only direct use of repository data here is via actions/checkout and git rev-parse, read-only access to repository contents is sufficient. We do not see any need for write access or for other scopes (issues, pull-requests, etc.) in this file.

The single best fix with minimal functional impact is to add a workflow-level permissions block right after the name: or on: section. This will apply to all jobs (prepare and the release_* jobs) unless a job overrides it. Use:

permissions:
  contents: read

This grants only read access to repository contents, which is enough for actions/checkout to function. No other code changes, imports, or definitions are required. Concretely, edit .github/workflows/onboarding_release_infra_resources.yml near the top so that lines after name: Infra Resources include the new permissions block.

In general, the fix is to explicitly declare a permissions: block so the GITHUB_TOKEN has only the minimal scopes required. Since the shown prepare job only needs to read the repository (for checkout and computing the SHA), and the downstream reusable workflows should declare any additional needs, the safest non‑breaking change is to add a workflow‑level permissions: block with read‑only permissions for contents (and optionally packages if needed, but we see no evidence here). This applies to all jobs that don’t override permissions, including prepare and the release_* jobs.

Concretely, in .github/workflows/onboarding_release_infra_resources.yml, add a top‑level permissions: block right after the name: line (before on:). Set it to:

permissions:
  contents: read

This will ensure GITHUB_TOKEN cannot perform write operations on repository contents from this workflow unless a specific job explicitly widens permissions, preserving existing behavior for read operations and the ability of the reusable workflow to define its own requirements. No imports, methods, or additional definitions are needed beyond this YAML change.

To fix the problem, explicitly define a restrictive permissions block in the workflow so that all jobs, including those that call the reusable workflow, run with least-privilege GITHUB_TOKEN permissions by default. Since the prepare job only checks out code and reads the current commit, it requires only contents: read. Without more context, the safest minimal explicit setting is a top-level permissions: contents: read, which applies to all jobs that don’t override it.

Concretely, edit .github/workflows/onboarding_release_infra_resources.yml near the top of the file, adding a root-level permissions: block between the name: and on: keys. No imports or additional methods are needed; this is purely a YAML configuration change. We do not modify any of the individual jobs or the uses: lines, preserving existing behavior while constraining GITHUB_TOKEN to read-only repository contents.

In general, the fix is to explicitly define permissions for the GITHUB_TOKEN in the workflow, restricting them to the minimum required. For a workflow that primarily checks out code and reads commit metadata, contents: read at the workflow root is typically sufficient. This avoids inheriting broader repository defaults and documents the workflow’s intended access.

The best single fix here, without changing functionality, is to add a root-level permissions: block (applies to all jobs that do not override it) right after the name: declaration, with contents: read. The called reusable workflow (onboarding_call_release_resources_infra.yml) may define its own permissions if it needs more, but we cannot modify it based on the snippet. The prepare job only needs read access to the repo to allow actions/checkout to function, so contents: read is adequate. No additional imports or external dependencies are involved; this is purely a YAML configuration change in .github/workflows/onboarding_release_infra_resources.yml.

Concretely:

• Edit .github/workflows/onboarding_release_infra_resources.yml.
• Insert:

  permissions:
    contents: read

  between the existing name: Infra Resources line and the on: block (lines 1–3 in the snippet).
• Leave all jobs and steps unchanged.

[andrea-putzu]

continer app conf is present as default

[andrea-putzu]

check for default quarkus probes

[andrea-putzu]

onboarding_ms_probes may be refactorized as ms_probes