Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>

* Update Gentoo package manager support

* docs: add info to CHANGES

Co-authored-by: Sijis Aviles <sijis.aviles@gmail.com>

)

* chore(deps): bump actions/setup-python from 2 to 3.1.0

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 2 to 3.1.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v2...v3.1.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* docs: update CHANGES

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sijis Aviles <sijis.aviles@gmail.com>

* fix: typo in pinned dependency

* docs: add info to CHANGES

* Prevent infinite loop when only BOT_PREFIX passed

* docs: add info to CHANGES

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* Use errbot log level with webserver for consistent logging.

* Formatting fixes for failing tests.

* fix: use correct PR number

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* chore: pin all dependencies

* docs: add info to CHANGES

* chore: Create issue templates

Updating the issue templates in project.

* chore: remove old issue template

* docs: add info to CHANGES

* chore: remove duplicate file

* Add ACL and backend documentation

* Add backends to official documentation.

* Update change loghttps://hub.docker.com/r/errbotio/errbot

* docs: update docker url

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* Add python 3.10 to automated testing

* fix: deprecated deamon thread deprecation warnings

* test: disable PytestCollectionWarning warnings

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* chore: remove python 3.6 testing

* chore: remove unneeded file

* chore: remove python 3.6 support

* style: format file

* docs: add info to CHANGES

* fix: add deprecation notice to Slack backend

* fix: add deprecation notice to SlackRTM backend

* docs: Add backend deprecation to CHANGES

* Adjust python version of plugins for current specs

* docs: add info to CHANGES

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* Update README.rst

* docs: Add info to CHANGES

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* style: format templates with black

* style: apply formatting to config-template

* docs: double quote example config parameters

* style: format plugin wizard output

* docs: Add info to CHANGES

* Add Typing for some files

* Add typing for Backends

* Update changes

* fix: remove extra spaces in logging output

* fix: formatting response

* fix: include plugin name in template logging output

* fix: include plugin name in log

* fix: remove extra spaces

* docs: Add info to CHANGES

* style: format files

* Adds ability to divert all to private or thread

This adds a `__magic_all__` option that you can add to either the
DIVERT_TO_THREAD or DIVERT_TO_PRIVATE configuration options instead of
adding each command individually.

* Only use one underscore

Two underscores looked great and more like the python way to do things
until I saw that some fonts were putting the two underscores into a
single underscore, and that would be confusing to end-users if the docs
said the same thing.  By using a single underscore and using the `'str'
in str` method both double-underscore and single-underscore values will
be acceptable.

* Lint fix

* style: lint

* fix: rename magic string to ALL_COMMANDS

* docs: add magic string to config-template

* docs: Add info to CHANGES

* fix: comment typo

* test: add initial basic check

Co-authored-by: Kirk Bater <kirk.bater@gmail.com>

* refactor: logic if storage plugin is open/closed

Also address a small typo in attribute check in open_storage()

* refactor: split test backend shutdown sequence

This should workaround a thread and storage timing problem.

* fix: move bot_thread to init

* test: disable failed circular dependency test

* docs: add test fixes to CHANGES

* chore: remove HipChat backend

* docs: remove Hipchat references

* docs: Add backend removal to CHANGES

* feat: add send_stream_request stub

* fix: room lookup

* docs: Add fixes to CHANGES

* refactor: change default backend to Text

* fix: setting default list of room occupants

This should address issue #1285

* docs: Add backend change to CHANGES

* Reload all plugins in a repo

`get_plugin_by_path` would only return the first plugin encountered in a
repository. This change adds the method `get_plugins_by_path` which yields
plugins as they are found.

For backwards compatibility, I have not deleted the original
`get_plugin_by_path` method, lest anyone use that method directly outside of
this package.

* docs: Add fixes to CHANGES

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* reproduce bug by unittest

* fix lose sub depends

* fix unit tests for linux systems

* add unit test from #1397

* fix codestyle

* docs: Add fixes to CHANGES

Co-authored-by: Ivan Novikov <i.novikov@cardsmobile.ru>
Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* Fix success handling for update_repos

As part of the switch to python git, the success case handling was reversed even though `0` was still meant to indicate success (formerly used to represent process exited without error).

89bce02#diff-b279f20d61152a2a99689009a59d70609c92039568c203da8c84bb56ceacd94fR287

This pull request fixes that issue and makes the code a bit more clear by using booleans rather than integers to represent the success state.

* docs: Add fixes to CHANGES

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* Use ShlexArgParser in lieu of SeparatorArgParser

Use ShlexArgParser in lieu of SeparatorArgParser

Some of the room commands in chatRoom.py use SeparatorArgParser which doesn’t correctly parse room names that contain spaces and are wrapped in double/single quotes. For example the command:

> room create "this is a new room"
< Created the room "this

> room create another new room
< Created the room another

By using ShlexArgParser the rooms with spaces and wrapped in double/single quotes will be parsed correctly. An arg without quotes or spaces will continue to be parsed correctly. For example:

> room create "this is a new room"
< Created the room this is a new room

> room list
< I'm currently in these rooms:
    this is a new room (group)
    <output cut for brevity>

> room create this_is_a_room_with_no_spaces_or_quotes@blah.com
< Created the room this_is_a_room_with_no_spaces_or_quotes@blah.com

> room list
< I'm currently in these rooms:
    this_is_a_room_with_no_spaces_or_quotes@blah.com (group)
    this is a new room (group)
    <output cut for brevity>

* docs: Add room with spaces reference

* test: Add initial validations

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* fix: Don't stop logging to file when using custom BOT_LOG_FORMATTER

* fix: Make BOT_LOG_FILE optional (don't break bot-start if not set)

* docs: Add fixes to CHANGES

Co-authored-by: Martin Flygenring <maf@one.com>
Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* Include command arguments as part of the ACL.

* test: include test scenarios

* docs: Add feature to CHANGES

* docs: Add new ACL filters to config template

* fix: remove duplicate entry in example

* style: formatting fixes

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* Make example_plugin_dir using not directly base_dir

* fix: fully resolve relative paths

* docs: update CHANGES

* style: formatted file

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* FIX xmpp delay value

In case of a delayed value defined in message is equal to localtime, it means there is no delay

* docs: update CHANGES

* style: formatting fixes

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* XMPP: delete extra parameter from join_muc() call

* docs: update CHANGES

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>

* allow users to add attachments to pytest messages as extras

* use keyword argument instead of positional

* change single quotes for double quotes

* docs: Add feature to CHANGES

Co-authored-by: Sijis Aviles <sijis.aviles+github@gmail.com>