diff --git a/.github/workflows/ci_codegen.yml b/.github/workflows/ci_codegen.yml index bea0148caa..1f657b4cad 100644 --- a/.github/workflows/ci_codegen.yml +++ b/.github/workflows/ci_codegen.yml @@ -10,6 +10,10 @@ on: jobs: code-generation: + permissions: + contents: read + pull-requests: write + id-token: write strategy: fail-fast: false matrix: diff --git a/.github/workflows/ci_duvet.yml b/.github/workflows/ci_duvet.yml index d5032a1a77..286209426f 100644 --- a/.github/workflows/ci_duvet.yml +++ b/.github/workflows/ci_duvet.yml @@ -11,6 +11,10 @@ on: jobs: duvet: + permissions: + contents: read + pull-requests: write + id-token: write runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/ci_static_analysis.yml b/.github/workflows/ci_static_analysis.yml index 50671bd193..97abdd51a7 100644 --- a/.github/workflows/ci_static_analysis.yml +++ b/.github/workflows/ci_static_analysis.yml @@ -9,6 +9,10 @@ on: jobs: not-grep: + permissions: + contents: read + pull-requests: write + id-token: write runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/ci_todos.yml b/.github/workflows/ci_todos.yml index 19373ac920..3e3e0abbb2 100644 --- a/.github/workflows/ci_todos.yml +++ b/.github/workflows/ci_todos.yml @@ -9,6 +9,10 @@ on: jobs: findTodos: + permissions: + contents: read + pull-requests: write + id-token: write runs-on: macos-14 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/dafny-interop.yml b/.github/workflows/dafny-interop.yml index da395dbfa4..fc1053d432 100644 --- a/.github/workflows/dafny-interop.yml +++ b/.github/workflows/dafny-interop.yml @@ -22,10 +22,18 @@ on: jobs: getMplHeadVersion: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/mpl_head_version.yml with: mpl-head: ${{inputs.mpl-commit}} dafny-interop-java: + permissions: + contents: read + pull-requests: write + id-token: write needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_java.yml with: @@ -34,6 +42,10 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-java-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_test_vector_java.yml with: @@ -42,6 +54,10 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-java-examples: + permissions: + contents: read + pull-requests: write + id-token: write needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_examples_java.yml with: @@ -50,18 +66,30 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-net: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_interop_test_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} mpl-commit: ${{inputs.mpl-commit}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-net-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_interop_test_vector_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} mpl-commit: ${{inputs.mpl-commit}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-net-examples: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_interop_examples_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} diff --git a/.github/workflows/dafny_verify_version.yml b/.github/workflows/dafny_verify_version.yml index 5a07e474ed..a35989ca5c 100644 --- a/.github/workflows/dafny_verify_version.yml +++ b/.github/workflows/dafny_verify_version.yml @@ -12,6 +12,10 @@ on: jobs: getDafnyVerifyVersion: + permissions: + contents: read + pull-requests: write + id-token: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.dafnyVerifyVersion }} diff --git a/.github/workflows/dafny_version.yml b/.github/workflows/dafny_version.yml index 822cbd48fe..a6e328ab8a 100644 --- a/.github/workflows/dafny_version.yml +++ b/.github/workflows/dafny_version.yml @@ -12,6 +12,10 @@ on: jobs: getDafnyVersion: + permissions: + contents: read + pull-requests: write + id-token: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.dafnyVersion }} diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml index 6f7e7f973d..0f4489f2d0 100644 --- a/.github/workflows/daily_ci.yml +++ b/.github/workflows/daily_ci.yml @@ -13,71 +13,127 @@ on: jobs: getVersion: + permissions: + contents: read + pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml getVerifyVersion: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_verify_version.yml daily-ci-format: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-codegen: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_codegen.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-verification: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVerifyVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} daily-ci-test-vector-verification: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} daily-ci-java: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-java-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-java-examples: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-net: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-rust: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-net-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-net-examples: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: dafny: ${{needs.getVersion.outputs.version}} notify: + permissions: + contents: read + pull-requests: write + id-token: write needs: [ getVersion, @@ -94,7 +150,7 @@ jobs: daily-ci-net-test-vectors, daily-ci-net-examples, ] - if: ${{ failure() }} + if: ${{ failure() && github.event_name == 'schedule'}} uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: message: "Daily CI failed on `${{ github.repository }}`. View run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" diff --git a/.github/workflows/go-release.yml b/.github/workflows/go-release.yml index a074a77b9c..5dc08e5b5b 100644 --- a/.github/workflows/go-release.yml +++ b/.github/workflows/go-release.yml @@ -14,6 +14,10 @@ on: jobs: get-dafny-version: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml go-release: diff --git a/.github/workflows/issue-notification.yml b/.github/workflows/issue-notification.yml index 88e6da5be2..0f80724323 100644 --- a/.github/workflows/issue-notification.yml +++ b/.github/workflows/issue-notification.yml @@ -7,6 +7,10 @@ on: jobs: notify-issue: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name == 'issues' uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: @@ -15,6 +19,10 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_GHI }} notify-comment: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name == 'issue_comment' && !github.event.issue.pull_request uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: diff --git a/.github/workflows/library_dafny_verification.yml b/.github/workflows/library_dafny_verification.yml index 0435cf4d34..42dd90006d 100644 --- a/.github/workflows/library_dafny_verification.yml +++ b/.github/workflows/library_dafny_verification.yml @@ -25,6 +25,10 @@ on: jobs: verification: + permissions: + contents: read + pull-requests: write + id-token: write # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: diff --git a/.github/workflows/library_format.yml b/.github/workflows/library_format.yml index 74bee64ba2..dad0a191f6 100644 --- a/.github/workflows/library_format.yml +++ b/.github/workflows/library_format.yml @@ -15,6 +15,10 @@ on: type: boolean jobs: format_projects: + permissions: + contents: read + pull-requests: write + id-token: write # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml index 8679b4f30b..9e01f79f24 100644 --- a/.github/workflows/manual.yml +++ b/.github/workflows/manual.yml @@ -18,51 +18,91 @@ on: jobs: manual-ci-format: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/library_format.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-verification: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-test-vector-verification: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-java: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-java-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-java-examples: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-net: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-rust: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-net-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-net-examples: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/ci_examples_net.yml with: dafny: ${{ inputs.dafny }} diff --git a/.github/workflows/mpl-head.yml b/.github/workflows/mpl-head.yml index 6e2e062344..278a570f42 100644 --- a/.github/workflows/mpl-head.yml +++ b/.github/workflows/mpl-head.yml @@ -8,24 +8,44 @@ on: jobs: getVersion: + permissions: + contents: read + pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml getVerifyVersion: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_verify_version.yml getMplHeadVersion: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/mpl_head_version.yml with: mpl-head: main mpl-head-ci-format: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml with: dafny: ${{needs.getVersion.outputs.version}} mpl-head-ci-verification: + permissions: + contents: read + pull-requests: write + id-token: write needs: [getVerifyVersion, getMplHeadVersion] if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -34,6 +54,10 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-test-vector-verification: + permissions: + contents: read + pull-requests: write + id-token: write needs: [getVerifyVersion, getMplHeadVersion] uses: ./.github/workflows/test_vector_verification.yml with: @@ -41,6 +65,10 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-java: + permissions: + contents: read + pull-requests: write + id-token: write needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_test_java.yml with: @@ -48,6 +76,10 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-java-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -55,6 +87,10 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-java-examples: + permissions: + contents: read + pull-requests: write + id-token: write needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_examples_java.yml with: @@ -62,24 +98,40 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-net: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{needs.getVersion.outputs.version}} mpl-head: true mpl-head-ci-rust: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{needs.getVersion.outputs.version}} mpl-head: true mpl-head-ci-net-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{needs.getVersion.outputs.version}} mpl-head: true mpl-head-ci-net-examples: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: diff --git a/.github/workflows/mpl_dependency_java_version.yml b/.github/workflows/mpl_dependency_java_version.yml index 1e181233d4..da41e7de9b 100644 --- a/.github/workflows/mpl_dependency_java_version.yml +++ b/.github/workflows/mpl_dependency_java_version.yml @@ -12,6 +12,10 @@ on: jobs: getMplDependencyJavaVersion: + permissions: + contents: read + pull-requests: write + id-token: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.mplDependencyJavaVersion }} diff --git a/.github/workflows/mpl_head_version.yml b/.github/workflows/mpl_head_version.yml index 08b789b3c5..eef4327d02 100644 --- a/.github/workflows/mpl_head_version.yml +++ b/.github/workflows/mpl_head_version.yml @@ -18,6 +18,10 @@ on: jobs: getMplHeadVersion: + permissions: + contents: read + pull-requests: write + id-token: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.mplVersion }} diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 20685555d4..8276f9b3d4 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -12,8 +12,16 @@ on: jobs: getVersion: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml dafny-nightly-format: + permissions: + contents: read + pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml @@ -21,6 +29,10 @@ jobs: dafny: "nightly-latest" regenerate-code: true dafny-nightly-verification: + permissions: + contents: read + pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -28,6 +40,10 @@ jobs: dafny: "nightly-latest" regenerate-code: true dafny-nightly-test-vector-verification: + permissions: + contents: read + pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/test_vector_verification.yml @@ -35,30 +51,50 @@ jobs: dafny: "nightly-latest" regenerate-code: true dafny-nightly-java: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_java.yml with: dafny: "nightly-latest" regenerate-code: true dafny-nightly-test-vectors-java: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: "nightly-latest" regenerate-code: true dafny-nightly-net: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_net.yml with: dafny: "nightly-latest" regenerate-code: true dafny-nightly-rust: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_rust_tests.yml with: dafny: "nightly-latest" regenerate-code: true dafny-nightly-test-vectors-net: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_vector_net.yml with: diff --git a/.github/workflows/non-prod.yml b/.github/workflows/non-prod.yml index d2514ed0b5..083bdff945 100644 --- a/.github/workflows/non-prod.yml +++ b/.github/workflows/non-prod.yml @@ -15,13 +15,25 @@ on: jobs: getVersion: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml pr-ci-go: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_go.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-all-required: + permissions: + contents: read + pull-requests: write + id-token: write if: always() needs: - getVersion diff --git a/.github/workflows/performance-benchmarks.yml b/.github/workflows/performance-benchmarks.yml index eb82758e51..7c956369a3 100644 --- a/.github/workflows/performance-benchmarks.yml +++ b/.github/workflows/performance-benchmarks.yml @@ -14,19 +14,35 @@ on: jobs: getVersion: + permissions: + contents: read + pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml performance-benchmarks-go: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/performance-benchmarks-go.yml with: dafny: ${{needs.getVersion.outputs.version}} performance-benchmarks-rust: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/performance-benchmarks-rust.yml with: dafny: ${{needs.getVersion.outputs.version}} notify: + permissions: + contents: read + pull-requests: write + id-token: write needs: [getVersion, performance-benchmarks-go, performance-benchmarks-rust] if: ${{ failure() }} uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml index aa95a53011..47ba389b17 100644 --- a/.github/workflows/pull.yml +++ b/.github/workflows/pull.yml @@ -10,65 +10,121 @@ on: jobs: getVersion: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml getVerifyVersion: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_verify_version.yml pr-ci-format: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_format.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-codegen: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_codegen.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-verification: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} pr-ci-test-vector-verification: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} pr-ci-java: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-java-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-java-examples: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-rust: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net-examples: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-all-required: + permissions: + contents: read + pull-requests: write + id-token: write if: always() needs: - getVersion diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 2388afaa33..07f40bd0df 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -12,60 +12,112 @@ on: jobs: getVersion: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml getVerifyVersion: + permissions: + contents: read + pull-requests: write + id-token: write uses: ./.github/workflows/dafny_verify_version.yml push-ci-format: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_format.yml with: dafny: ${{needs.getVersion.outputs.version}} push-ci-codegen: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_codegen.yml with: dafny: ${{needs.getVersion.outputs.version}} push-ci-verification: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} push-ci-test-vector-verification: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} pr-ci-java: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-java-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-java-examples: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-rust: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net-test-vectors: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net-examples: + permissions: + contents: read + pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: diff --git a/.github/workflows/test_vector_verification.yml b/.github/workflows/test_vector_verification.yml index 754204b7da..006b107cf1 100644 --- a/.github/workflows/test_vector_verification.yml +++ b/.github/workflows/test_vector_verification.yml @@ -25,6 +25,10 @@ on: jobs: verification: + permissions: + contents: read + pull-requests: write + id-token: write # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: