Update resource types to use hardened images

[svenaas]

Fixes #4384

Changes proposed in this pull request:

• Update pipelines to use our current hardened images
• Clean up on hook notifications

security considerations

Replace CI resource types with hardened image

[apburnes]

Make sure to also add the hardened git resource for the staging and production pipelines.

[svenaas]

@apburnes Thanks for that review — that was a specific detail I was unsure of. I believe I've addressed all of the pr-((git-branch)) instances that needed to be removed.

[svenaas]

@apburnes Thanks for that review — that was a specific detail I was unsure of. I believe I've addressed all of the pr-((git-branch)) instances that needed to be removed.

(There are more in the dev pipeline, but in a PR context, I believe.)

[svenaas]

Make sure to also add the hardened git resource for the staging and production pipelines.

Not sure which one you mean. cogito is removed and github-pr-resource is added in those pipelines. Do we need git-resource also?

[svenaas]

I think I've addressed every comment except for the following, about which my open question is below:

Make sure to also add the hardened git resource for the staging and production pipelines.

Not sure which one you mean. cogito is removed and github-pr-resource is added in those pipelines. Do we need git-resource also?

[svenaas]

Thanks for swinging in on this!

[svenaas]

Noticing I didn't include "(#4384)" in the original commit message, but maybe we can let that be.

[svenaas]

Noticing I didn't include "(#4384)" in the original commit message

That would be because this PR is #4383 and I would have had to time travel. Which git rebase -i allows...

Updated