Add explicit permissions to 4.x workflows. Backport to the 5.0.0 branch

.github/workflows/4_build_and_push_images.yml

@@ -213,6 +213,10 @@ jobs:
 
   notify:
     runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+
+    permissions:
+      contents: read
+
     needs: [setup, build-and-push]
     # Only run if NOT dev AND all products were selected
     if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}

.github/workflows/4_pr_check.yml

@@ -12,6 +12,9 @@ on:
       - 'wazuh-agent/**'
       - '.github/**'
 
+permissions:
+  contents: read
+
 env:
   ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
   ARTIFACT_NAMES: |

.github/workflows/5_changelog_check.yml

@@ -31,13 +31,11 @@ jobs:
           else
             FORMAT="✅"
 
-            TABLE_ENTRY_REGEX='^\| \[#[0-9]+\]\(https://github\.com/[^)]+/(issues|pull)/[0-9]+\) \| .+ \|$'
-            TABLE_HEADER_REGEX='^\| Issue \| Comment \|$|^\| - \| - \|$'
-            PRIOR_VERSION_REGEX='^- \[v?[0-9]+\.[0-9]+\.[0-9]+\]\(https://github\.com/[^)]+/blob/[^)]+/CHANGELOG\.md\)$|^- \[\]\(\)$'
-            INVALID=$(echo "$ADDED" | grep -E '^(\||-)' | grep -vx -- '- None' | grep -vE "$TABLE_HEADER_REGEX" | grep -vE "$TABLE_ENTRY_REGEX" | grep -vE "$PRIOR_VERSION_REGEX" || true)
+            ENTRY_REGEX='^- .+ \(\[#[0-9]+\]\(https://github\.com/[^)]+/(issues|pull)/[0-9]+\)\)$'
+            INVALID=$(echo "$ADDED" | grep -E '^- ' | grep -vx -- '- None' | grep -vE "$ENTRY_REGEX" || true)
             if [ -n "$INVALID" ]; then
               FORMAT="❌"
-              echo "::error::Invalid CHANGELOG.md entries. Expected format: '- Description ([#123](https://github.com/<org>/<repo>/issues/123))' or, for the Prior versions section, '- [vX.X.X](https://github.com/<org>/<repo>/blob/vX.X.X/CHANGELOG.md)'. Offending lines:"
+              echo "::error::Invalid CHANGELOG.md entries. Expected format: '- Description ([#123](https://github.com/<org>/<repo>/issues/123))'. Offending lines:"
               echo "$INVALID"
             fi
           fi

CHANGELOG.md

@@ -74,8 +74,6 @@
 
 | Issue | Comment |
 | - | - |
-| [#9999](https://github.com/wazuh/wazuh-docker/issues/9999) | Test entry to validate changelog check regex (standard entry) |
-| [#2563](https://github.com/wazuh/wazuh-docker/issues/2563) | Fixed changelog check workflow to accept Prior versions entries |
 | [#2533](https://github.com/wazuh/wazuh-docker/pull/2533) | Fix bumper workflow failure when bump produces no changes |
 | [#2477](https://github.com/wazuh/wazuh-docker/issues/2477) | Bumper script issue when the tag is set to false |
 | [#2443](https://github.com/wazuh/wazuh-docker/issues/2443) | Fix reported WF vulnerabilities |
@@ -89,4 +87,3 @@
 
 ## Prior versions
 - []()
-- [v4.14.99](https://github.com/wazuh/wazuh-docker/blob/v4.14.99/CHANGELOG.md)