ci: Harden workflows

.github/workflows/build.yaml

@@ -83,9 +83,8 @@ jobs:
           submodules: recursive
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+        shell: bash
+        run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
 
       - name: Setup Rust Cache
         uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
@@ -160,9 +159,8 @@ jobs:
         uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+        shell: bash
+        run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
 
       - name: Build Container Image
         id: build

.github/workflows/integration-test.yml

@@ -23,6 +23,8 @@ on:
       test:
         description: Name of the test. Only used of test-mode is `custom`
 
+permissions: {}
+
 jobs:
   test:
     name: Run Integration Test

.github/workflows/pr_prek.yaml

@@ -5,12 +5,13 @@ on:
   pull_request:
   merge_group:
 
+permissions: {}
+
 env:
   CARGO_TERM_COLOR: always
   NIX_PKG_MANAGER_VERSION: "2.33.3"
   RUST_TOOLCHAIN_VERSION: "nightly-2026-02-24"
   HADOLINT_VERSION: "v2.14.0"
-  PYTHON_VERSION: "3.14"
   JINJA2_CLI_VERSION: "1.0.0"
 
 jobs:
@@ -29,7 +30,6 @@ jobs:
           fetch-depth: 0
       - uses: stackabletech/actions/run-prek@a14cbd08d9e034e2361ea9205b32aff0491885db # v0.15.0
         with:
-          python-version: ${{ env.PYTHON_VERSION }}
           rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
           hadolint: ${{ env.HADOLINT_VERSION }}
           nix: ${{ env.NIX_PKG_MANAGER_VERSION }}

.pre-commit-config.yaml

@@ -38,6 +38,10 @@ repos:
     hooks:
       - id: shellcheck
         args: ["--severity=info"]
+        # Temporarily needed until all getting_started.sh.j2 scripts are made non-executable.
+        # As long as they are, prek will treat them as shell scripts and so this hook will fail.
+        # pre-commit behaves differently apparently and doesn't pass .j2 files to this hook.
+        exclude: \.j2$
 
   # WARNING (@NickLarsenNZ): Nix users need to install ruff first.
   # If you do not, you will need to delete the cached ruff binary shown in the

scripts/docs_templating.sh

@@ -38,4 +38,7 @@ do
   jinja2 "$file" "$templating_vars_file" -o "$new_file_name"
 done
 
+# Ensure this script is executable
+chmod +x docs/modules/opensearch/examples/getting_started/getting_started.sh
+
 echo "done"