[Bug]: Harden the APM package update workflow template

[kichasov]

Describe the bug

The apm-packages-update.yml workflow template grants write
permissions to the automatic GITHUB_TOKEN, has no concurrency control, and
does not set a job timeout.

The template passes APM_UPDATE_TOKEN to checkout and to
apm-packages-update. The action uses that explicit input token to create or
update its pull request and the fixed chore/update-apm-packages branch.
Therefore, the job-level GITHUB_TOKEN does not need contents: write or
pull-requests: write.

Without concurrency, a scheduled run and a manual run can update the same
branch and pull request concurrently. Without timeout-minutes, a stuck
maintenance job can consume a runner for the default six-hour limit.

To Reproduce

1. Open the APM package update workflow template.
2. Inspect the test-apm-update job:
   • permissions grants contents: write and pull-requests: write;
   • the job has no timeout-minutes;
   • the workflow has no concurrency block.
3. Trigger two runs of a workflow generated from this template, for example a
   scheduled run and workflow_dispatch.
4. Both runs invoke apm-packages-update, which uses the fixed
   chore/update-apm-packages branch.

Version

• Template: Netcracker/.github/workflow-templates/apm-packages-update.yml
• Related action: netcracker/qubership-workflow-hub/actions/apm-packages-update
• Related action issue:
  qubership-workflow-hub#949

Logs

Not applicable. The problem is visible in the template configuration before a
workflow run starts.

Additional information

Update the template as follows:

1. Set job-level permissions to contents: read only. The action receives its
   write-capable APM_UPDATE_TOKEN explicitly.

2. Add a single-flight concurrency group, for example:

   concurrency:
     group: apm-packages-update-${{ github.repository }}
     cancel-in-progress: false

3. Add timeout-minutes: 20 to the test-apm-update job.

The action-version compatibility problem is tracked separately in
qubership-workflow-hub#949.

[nookyo]

Hi @kichasov !
Thanks for the report. We reviewed the template and will reduce the job-level GITHUB_TOKEN permissions to contents: read. Checkout only needs the read-only automatic token, while branch updates and pull request creation explicitly use APM_UPDATE_TOKEN.

We do not plan to add the proposed concurrency group or a fixed 20-minute timeout at this time:

• The workflow is scheduled weekly, and the supported manual invocation is an intentional operational escape hatch. We have no evidence of concurrent runs causing a failed or corrupted update; the update action also targets the same update branch and existing PR.
• A fixed 20-minute timeout is not justified by a reported stuck run and may turn network or dependency-resolution delays into false failures.

If we observe an actual collision or an unbounded run, we can revisit both controls with run data and a timeout appropriate to observed execution times. The APM CLI/lockfile compatibility issue is tracked separately in Netcracker/qubership-workflow-hub#949.