From 3cd612b56f42f0c456ccef6e3019fe8d6e0f2fb4 Mon Sep 17 00:00:00 2001 From: texastony <5892063+texastony@users.noreply.github.com> Date: Mon, 16 Mar 2026 10:34:24 -0700 Subject: [PATCH 1/4] chore: add permissions: contents: read to all workflow jobs --- .github/workflows/ci_codegen.yml | 2 ++ .github/workflows/ci_duvet.yml | 2 ++ .github/workflows/ci_static_analysis.yml | 2 ++ .github/workflows/ci_todos.yml | 2 ++ .github/workflows/dafny-interop.yml | 14 ++++++++++ .github/workflows/dafny_verify_version.yml | 2 ++ .github/workflows/dafny_version.yml | 2 ++ .github/workflows/daily_ci.yml | 28 +++++++++++++++++++ .github/workflows/go-release.yml | 2 ++ .github/workflows/issue-notification.yml | 4 +++ .../workflows/library_dafny_verification.yml | 2 ++ .github/workflows/library_format.yml | 2 ++ .github/workflows/manual.yml | 20 +++++++++++++ .github/workflows/mpl-head.yml | 26 +++++++++++++++++ .../workflows/mpl_dependency_java_version.yml | 2 ++ .github/workflows/mpl_head_version.yml | 2 ++ .github/workflows/nightly.yml | 18 ++++++++++++ .github/workflows/non-prod.yml | 6 ++++ .github/workflows/performance-benchmarks.yml | 8 ++++++ .github/workflows/pull.yml | 28 +++++++++++++++++++ .github/workflows/push.yml | 26 +++++++++++++++++ .../workflows/test_vector_verification.yml | 2 ++ 22 files changed, 202 insertions(+) diff --git a/.github/workflows/ci_codegen.yml b/.github/workflows/ci_codegen.yml index bea0148caa..4e3146a671 100644 --- a/.github/workflows/ci_codegen.yml +++ b/.github/workflows/ci_codegen.yml @@ -10,6 +10,8 @@ on: jobs: code-generation: + permissions: + contents: read strategy: fail-fast: false matrix: diff --git a/.github/workflows/ci_duvet.yml b/.github/workflows/ci_duvet.yml index d5032a1a77..3254291468 100644 --- a/.github/workflows/ci_duvet.yml +++ b/.github/workflows/ci_duvet.yml @@ -11,6 +11,8 @@ on: jobs: duvet: + permissions: + contents: read runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/ci_static_analysis.yml b/.github/workflows/ci_static_analysis.yml index 50671bd193..1b2f556e13 100644 --- a/.github/workflows/ci_static_analysis.yml +++ b/.github/workflows/ci_static_analysis.yml @@ -9,6 +9,8 @@ on: jobs: not-grep: + permissions: + contents: read runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/ci_todos.yml b/.github/workflows/ci_todos.yml index 19373ac920..adda4b4316 100644 --- a/.github/workflows/ci_todos.yml +++ b/.github/workflows/ci_todos.yml @@ -9,6 +9,8 @@ on: jobs: findTodos: + permissions: + contents: read runs-on: macos-14 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/dafny-interop.yml b/.github/workflows/dafny-interop.yml index da395dbfa4..c6ef53e8b4 100644 --- a/.github/workflows/dafny-interop.yml +++ b/.github/workflows/dafny-interop.yml @@ -22,10 +22,14 @@ on: jobs: getMplHeadVersion: + permissions: + contents: read uses: ./.github/workflows/mpl_head_version.yml with: mpl-head: ${{inputs.mpl-commit}} dafny-interop-java: + permissions: + contents: read needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_java.yml with: @@ -34,6 +38,8 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-java-test-vectors: + permissions: + contents: read needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_test_vector_java.yml with: @@ -42,6 +48,8 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-java-examples: + permissions: + contents: read needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_examples_java.yml with: @@ -50,18 +58,24 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-net: + permissions: + contents: read uses: ./.github/workflows/dafny_interop_test_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} mpl-commit: ${{inputs.mpl-commit}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-net-test-vectors: + permissions: + contents: read uses: ./.github/workflows/dafny_interop_test_vector_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} mpl-commit: ${{inputs.mpl-commit}} dbesdk-dafny: ${{inputs.dbesdk-dafny}} dafny-interop-net-examples: + permissions: + contents: read uses: ./.github/workflows/dafny_interop_examples_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} diff --git a/.github/workflows/dafny_verify_version.yml b/.github/workflows/dafny_verify_version.yml index 5a07e474ed..d7e9094ed0 100644 --- a/.github/workflows/dafny_verify_version.yml +++ b/.github/workflows/dafny_verify_version.yml @@ -12,6 +12,8 @@ on: jobs: getDafnyVerifyVersion: + permissions: + contents: read runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.dafnyVerifyVersion }} diff --git a/.github/workflows/dafny_version.yml b/.github/workflows/dafny_version.yml index 822cbd48fe..99f8d951b6 100644 --- a/.github/workflows/dafny_version.yml +++ b/.github/workflows/dafny_version.yml @@ -12,6 +12,8 @@ on: jobs: getDafnyVersion: + permissions: + contents: read runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.dafnyVersion }} diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml index 6f7e7f973d..d9dc20a81e 100644 --- a/.github/workflows/daily_ci.yml +++ b/.github/workflows/daily_ci.yml @@ -13,71 +13,99 @@ on: jobs: getVersion: + permissions: + contents: read # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml getVerifyVersion: + permissions: + contents: read if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_verify_version.yml daily-ci-format: + permissions: + contents: read needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-codegen: + permissions: + contents: read needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_codegen.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-verification: + permissions: + contents: read needs: getVerifyVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} daily-ci-test-vector-verification: + permissions: + contents: read needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} daily-ci-java: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-java-test-vectors: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-java-examples: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-net: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-rust: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-net-test-vectors: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{needs.getVersion.outputs.version}} daily-ci-net-examples: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: dafny: ${{needs.getVersion.outputs.version}} notify: + permissions: + contents: read needs: [ getVersion, diff --git a/.github/workflows/go-release.yml b/.github/workflows/go-release.yml index a074a77b9c..22d62a1604 100644 --- a/.github/workflows/go-release.yml +++ b/.github/workflows/go-release.yml @@ -14,6 +14,8 @@ on: jobs: get-dafny-version: + permissions: + contents: read uses: ./.github/workflows/dafny_version.yml go-release: diff --git a/.github/workflows/issue-notification.yml b/.github/workflows/issue-notification.yml index 88e6da5be2..ef0ac88de6 100644 --- a/.github/workflows/issue-notification.yml +++ b/.github/workflows/issue-notification.yml @@ -7,6 +7,8 @@ on: jobs: notify-issue: + permissions: + contents: read if: github.event_name == 'issues' uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: @@ -15,6 +17,8 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_GHI }} notify-comment: + permissions: + contents: read if: github.event_name == 'issue_comment' && !github.event.issue.pull_request uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: diff --git a/.github/workflows/library_dafny_verification.yml b/.github/workflows/library_dafny_verification.yml index 0435cf4d34..66291cbec1 100644 --- a/.github/workflows/library_dafny_verification.yml +++ b/.github/workflows/library_dafny_verification.yml @@ -25,6 +25,8 @@ on: jobs: verification: + permissions: + contents: read # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: diff --git a/.github/workflows/library_format.yml b/.github/workflows/library_format.yml index 74bee64ba2..e84619ced4 100644 --- a/.github/workflows/library_format.yml +++ b/.github/workflows/library_format.yml @@ -15,6 +15,8 @@ on: type: boolean jobs: format_projects: + permissions: + contents: read # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml index 8679b4f30b..62ce0c41be 100644 --- a/.github/workflows/manual.yml +++ b/.github/workflows/manual.yml @@ -18,51 +18,71 @@ on: jobs: manual-ci-format: + permissions: + contents: read uses: ./.github/workflows/library_format.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-verification: + permissions: + contents: read uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-test-vector-verification: + permissions: + contents: read uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-java: + permissions: + contents: read uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-java-test-vectors: + permissions: + contents: read uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-java-examples: + permissions: + contents: read uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-net: + permissions: + contents: read uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-rust: + permissions: + contents: read uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-net-test-vectors: + permissions: + contents: read uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{ inputs.dafny }} regenerate-code: ${{ inputs.regenerate-code }} manual-ci-net-examples: + permissions: + contents: read uses: ./.github/workflows/ci_examples_net.yml with: dafny: ${{ inputs.dafny }} diff --git a/.github/workflows/mpl-head.yml b/.github/workflows/mpl-head.yml index 6e2e062344..a46a20207c 100644 --- a/.github/workflows/mpl-head.yml +++ b/.github/workflows/mpl-head.yml @@ -8,24 +8,34 @@ on: jobs: getVersion: + permissions: + contents: read # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml getVerifyVersion: + permissions: + contents: read if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_verify_version.yml getMplHeadVersion: + permissions: + contents: read if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/mpl_head_version.yml with: mpl-head: main mpl-head-ci-format: + permissions: + contents: read needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml with: dafny: ${{needs.getVersion.outputs.version}} mpl-head-ci-verification: + permissions: + contents: read needs: [getVerifyVersion, getMplHeadVersion] if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -34,6 +44,8 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-test-vector-verification: + permissions: + contents: read needs: [getVerifyVersion, getMplHeadVersion] uses: ./.github/workflows/test_vector_verification.yml with: @@ -41,6 +53,8 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-java: + permissions: + contents: read needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_test_java.yml with: @@ -48,6 +62,8 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-java-test-vectors: + permissions: + contents: read needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -55,6 +71,8 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-java-examples: + permissions: + contents: read needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_examples_java.yml with: @@ -62,24 +80,32 @@ jobs: mpl-version: ${{needs.getMplHeadVersion.outputs.version}} mpl-head: true mpl-head-ci-net: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{needs.getVersion.outputs.version}} mpl-head: true mpl-head-ci-rust: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{needs.getVersion.outputs.version}} mpl-head: true mpl-head-ci-net-test-vectors: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{needs.getVersion.outputs.version}} mpl-head: true mpl-head-ci-net-examples: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: diff --git a/.github/workflows/mpl_dependency_java_version.yml b/.github/workflows/mpl_dependency_java_version.yml index 1e181233d4..9a98e24622 100644 --- a/.github/workflows/mpl_dependency_java_version.yml +++ b/.github/workflows/mpl_dependency_java_version.yml @@ -12,6 +12,8 @@ on: jobs: getMplDependencyJavaVersion: + permissions: + contents: read runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.mplDependencyJavaVersion }} diff --git a/.github/workflows/mpl_head_version.yml b/.github/workflows/mpl_head_version.yml index 08b789b3c5..6dbc00f392 100644 --- a/.github/workflows/mpl_head_version.yml +++ b/.github/workflows/mpl_head_version.yml @@ -18,6 +18,8 @@ on: jobs: getMplHeadVersion: + permissions: + contents: read runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.mplVersion }} diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 20685555d4..c205c2ca57 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -12,8 +12,12 @@ on: jobs: getVersion: + permissions: + contents: read uses: ./.github/workflows/dafny_version.yml dafny-nightly-format: + permissions: + contents: read # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml @@ -21,6 +25,8 @@ jobs: dafny: "nightly-latest" regenerate-code: true dafny-nightly-verification: + permissions: + contents: read # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -28,6 +34,8 @@ jobs: dafny: "nightly-latest" regenerate-code: true dafny-nightly-test-vector-verification: + permissions: + contents: read # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/test_vector_verification.yml @@ -35,30 +43,40 @@ jobs: dafny: "nightly-latest" regenerate-code: true dafny-nightly-java: + permissions: + contents: read if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_java.yml with: dafny: "nightly-latest" regenerate-code: true dafny-nightly-test-vectors-java: + permissions: + contents: read if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: "nightly-latest" regenerate-code: true dafny-nightly-net: + permissions: + contents: read if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_net.yml with: dafny: "nightly-latest" regenerate-code: true dafny-nightly-rust: + permissions: + contents: read if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_rust_tests.yml with: dafny: "nightly-latest" regenerate-code: true dafny-nightly-test-vectors-net: + permissions: + contents: read if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_vector_net.yml with: diff --git a/.github/workflows/non-prod.yml b/.github/workflows/non-prod.yml index d2514ed0b5..ab2a6f8acf 100644 --- a/.github/workflows/non-prod.yml +++ b/.github/workflows/non-prod.yml @@ -15,13 +15,19 @@ on: jobs: getVersion: + permissions: + contents: read uses: ./.github/workflows/dafny_version.yml pr-ci-go: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_go.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-all-required: + permissions: + contents: read if: always() needs: - getVersion diff --git a/.github/workflows/performance-benchmarks.yml b/.github/workflows/performance-benchmarks.yml index eb82758e51..b313b0cd84 100644 --- a/.github/workflows/performance-benchmarks.yml +++ b/.github/workflows/performance-benchmarks.yml @@ -14,19 +14,27 @@ on: jobs: getVersion: + permissions: + contents: read if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml performance-benchmarks-go: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/performance-benchmarks-go.yml with: dafny: ${{needs.getVersion.outputs.version}} performance-benchmarks-rust: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/performance-benchmarks-rust.yml with: dafny: ${{needs.getVersion.outputs.version}} notify: + permissions: + contents: read needs: [getVersion, performance-benchmarks-go, performance-benchmarks-rust] if: ${{ failure() }} uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml index aa95a53011..caa2f59596 100644 --- a/.github/workflows/pull.yml +++ b/.github/workflows/pull.yml @@ -10,65 +10,93 @@ on: jobs: getVersion: + permissions: + contents: read uses: ./.github/workflows/dafny_version.yml getVerifyVersion: + permissions: + contents: read uses: ./.github/workflows/dafny_verify_version.yml pr-ci-format: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/library_format.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-codegen: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_codegen.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-verification: + permissions: + contents: read needs: getVerifyVersion uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} pr-ci-test-vector-verification: + permissions: + contents: read needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} pr-ci-java: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-java-test-vectors: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-java-examples: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-rust: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net-test-vectors: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net-examples: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-all-required: + permissions: + contents: read if: always() needs: - getVersion diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 2388afaa33..cb70a25af0 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -12,60 +12,86 @@ on: jobs: getVersion: + permissions: + contents: read uses: ./.github/workflows/dafny_version.yml getVerifyVersion: + permissions: + contents: read uses: ./.github/workflows/dafny_verify_version.yml push-ci-format: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/library_format.yml with: dafny: ${{needs.getVersion.outputs.version}} push-ci-codegen: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_codegen.yml with: dafny: ${{needs.getVersion.outputs.version}} push-ci-verification: + permissions: + contents: read needs: getVerifyVersion uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} push-ci-test-vector-verification: + permissions: + contents: read needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{needs.getVerifyVersion.outputs.version}} pr-ci-java: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-java-test-vectors: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-java-examples: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-rust: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net-test-vectors: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{needs.getVersion.outputs.version}} pr-ci-net-examples: + permissions: + contents: read needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: diff --git a/.github/workflows/test_vector_verification.yml b/.github/workflows/test_vector_verification.yml index 754204b7da..c353b62af2 100644 --- a/.github/workflows/test_vector_verification.yml +++ b/.github/workflows/test_vector_verification.yml @@ -25,6 +25,8 @@ on: jobs: verification: + permissions: + contents: read # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: From e60869746aa5d8a48191cc4db39e548b0a0c3ea3 Mon Sep 17 00:00:00 2001 From: texastony <5892063+texastony@users.noreply.github.com> Date: Mon, 16 Mar 2026 10:45:23 -0700 Subject: [PATCH 2/4] chore: add pull-requests: write to new job-level permissions --- .github/workflows/ci_codegen.yml | 1 + .github/workflows/ci_duvet.yml | 1 + .github/workflows/ci_static_analysis.yml | 1 + .github/workflows/ci_todos.yml | 1 + .github/workflows/dafny-interop.yml | 7 +++++++ .github/workflows/dafny_verify_version.yml | 1 + .github/workflows/dafny_version.yml | 1 + .github/workflows/daily_ci.yml | 14 ++++++++++++++ .github/workflows/go-release.yml | 1 + .github/workflows/issue-notification.yml | 2 ++ .github/workflows/library_dafny_verification.yml | 1 + .github/workflows/library_format.yml | 1 + .github/workflows/manual.yml | 10 ++++++++++ .github/workflows/mpl-head.yml | 13 +++++++++++++ .github/workflows/mpl_dependency_java_version.yml | 1 + .github/workflows/mpl_head_version.yml | 1 + .github/workflows/nightly.yml | 9 +++++++++ .github/workflows/non-prod.yml | 3 +++ .github/workflows/performance-benchmarks.yml | 4 ++++ .github/workflows/pull.yml | 14 ++++++++++++++ .github/workflows/push.yml | 13 +++++++++++++ .github/workflows/test_vector_verification.yml | 1 + 22 files changed, 101 insertions(+) diff --git a/.github/workflows/ci_codegen.yml b/.github/workflows/ci_codegen.yml index 4e3146a671..58b432ed2e 100644 --- a/.github/workflows/ci_codegen.yml +++ b/.github/workflows/ci_codegen.yml @@ -12,6 +12,7 @@ jobs: code-generation: permissions: contents: read + pull-requests: write strategy: fail-fast: false matrix: diff --git a/.github/workflows/ci_duvet.yml b/.github/workflows/ci_duvet.yml index 3254291468..cae309ba86 100644 --- a/.github/workflows/ci_duvet.yml +++ b/.github/workflows/ci_duvet.yml @@ -13,6 +13,7 @@ jobs: duvet: permissions: contents: read + pull-requests: write runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/ci_static_analysis.yml b/.github/workflows/ci_static_analysis.yml index 1b2f556e13..db70f2062f 100644 --- a/.github/workflows/ci_static_analysis.yml +++ b/.github/workflows/ci_static_analysis.yml @@ -11,6 +11,7 @@ jobs: not-grep: permissions: contents: read + pull-requests: write runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/ci_todos.yml b/.github/workflows/ci_todos.yml index adda4b4316..d2f1f343a2 100644 --- a/.github/workflows/ci_todos.yml +++ b/.github/workflows/ci_todos.yml @@ -11,6 +11,7 @@ jobs: findTodos: permissions: contents: read + pull-requests: write runs-on: macos-14 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/dafny-interop.yml b/.github/workflows/dafny-interop.yml index c6ef53e8b4..da222c2d06 100644 --- a/.github/workflows/dafny-interop.yml +++ b/.github/workflows/dafny-interop.yml @@ -24,12 +24,14 @@ jobs: getMplHeadVersion: permissions: contents: read + pull-requests: write uses: ./.github/workflows/mpl_head_version.yml with: mpl-head: ${{inputs.mpl-commit}} dafny-interop-java: permissions: contents: read + pull-requests: write needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_java.yml with: @@ -40,6 +42,7 @@ jobs: dafny-interop-java-test-vectors: permissions: contents: read + pull-requests: write needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_test_vector_java.yml with: @@ -50,6 +53,7 @@ jobs: dafny-interop-java-examples: permissions: contents: read + pull-requests: write needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_examples_java.yml with: @@ -60,6 +64,7 @@ jobs: dafny-interop-net: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_interop_test_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} @@ -68,6 +73,7 @@ jobs: dafny-interop-net-test-vectors: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_interop_test_vector_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} @@ -76,6 +82,7 @@ jobs: dafny-interop-net-examples: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_interop_examples_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} diff --git a/.github/workflows/dafny_verify_version.yml b/.github/workflows/dafny_verify_version.yml index d7e9094ed0..590207ae9f 100644 --- a/.github/workflows/dafny_verify_version.yml +++ b/.github/workflows/dafny_verify_version.yml @@ -14,6 +14,7 @@ jobs: getDafnyVerifyVersion: permissions: contents: read + pull-requests: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.dafnyVerifyVersion }} diff --git a/.github/workflows/dafny_version.yml b/.github/workflows/dafny_version.yml index 99f8d951b6..fc1248e288 100644 --- a/.github/workflows/dafny_version.yml +++ b/.github/workflows/dafny_version.yml @@ -14,6 +14,7 @@ jobs: getDafnyVersion: permissions: contents: read + pull-requests: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.dafnyVersion }} diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml index d9dc20a81e..02582b84c4 100644 --- a/.github/workflows/daily_ci.yml +++ b/.github/workflows/daily_ci.yml @@ -15,17 +15,20 @@ jobs: getVersion: permissions: contents: read + pull-requests: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml getVerifyVersion: permissions: contents: read + pull-requests: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_verify_version.yml daily-ci-format: permissions: contents: read + pull-requests: write needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml @@ -34,6 +37,7 @@ jobs: daily-ci-codegen: permissions: contents: read + pull-requests: write needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_codegen.yml @@ -42,6 +46,7 @@ jobs: daily-ci-verification: permissions: contents: read + pull-requests: write needs: getVerifyVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -50,6 +55,7 @@ jobs: daily-ci-test-vector-verification: permissions: contents: read + pull-requests: write needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: @@ -57,6 +63,7 @@ jobs: daily-ci-java: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: @@ -64,6 +71,7 @@ jobs: daily-ci-java-test-vectors: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -71,6 +79,7 @@ jobs: daily-ci-java-examples: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: @@ -78,6 +87,7 @@ jobs: daily-ci-net: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: @@ -85,6 +95,7 @@ jobs: daily-ci-rust: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: @@ -92,6 +103,7 @@ jobs: daily-ci-net-test-vectors: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: @@ -99,6 +111,7 @@ jobs: daily-ci-net-examples: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: @@ -106,6 +119,7 @@ jobs: notify: permissions: contents: read + pull-requests: write needs: [ getVersion, diff --git a/.github/workflows/go-release.yml b/.github/workflows/go-release.yml index 22d62a1604..1b6750aa36 100644 --- a/.github/workflows/go-release.yml +++ b/.github/workflows/go-release.yml @@ -16,6 +16,7 @@ jobs: get-dafny-version: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_version.yml go-release: diff --git a/.github/workflows/issue-notification.yml b/.github/workflows/issue-notification.yml index ef0ac88de6..d86501d0e6 100644 --- a/.github/workflows/issue-notification.yml +++ b/.github/workflows/issue-notification.yml @@ -9,6 +9,7 @@ jobs: notify-issue: permissions: contents: read + pull-requests: write if: github.event_name == 'issues' uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: @@ -19,6 +20,7 @@ jobs: notify-comment: permissions: contents: read + pull-requests: write if: github.event_name == 'issue_comment' && !github.event.issue.pull_request uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: diff --git a/.github/workflows/library_dafny_verification.yml b/.github/workflows/library_dafny_verification.yml index 66291cbec1..e432481a9a 100644 --- a/.github/workflows/library_dafny_verification.yml +++ b/.github/workflows/library_dafny_verification.yml @@ -27,6 +27,7 @@ jobs: verification: permissions: contents: read + pull-requests: write # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: diff --git a/.github/workflows/library_format.yml b/.github/workflows/library_format.yml index e84619ced4..630a27f99e 100644 --- a/.github/workflows/library_format.yml +++ b/.github/workflows/library_format.yml @@ -17,6 +17,7 @@ jobs: format_projects: permissions: contents: read + pull-requests: write # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml index 62ce0c41be..7c00bf64c5 100644 --- a/.github/workflows/manual.yml +++ b/.github/workflows/manual.yml @@ -20,6 +20,7 @@ jobs: manual-ci-format: permissions: contents: read + pull-requests: write uses: ./.github/workflows/library_format.yml with: dafny: ${{ inputs.dafny }} @@ -27,6 +28,7 @@ jobs: manual-ci-verification: permissions: contents: read + pull-requests: write uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{ inputs.dafny }} @@ -34,6 +36,7 @@ jobs: manual-ci-test-vector-verification: permissions: contents: read + pull-requests: write uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{ inputs.dafny }} @@ -41,6 +44,7 @@ jobs: manual-ci-java: permissions: contents: read + pull-requests: write uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{ inputs.dafny }} @@ -48,6 +52,7 @@ jobs: manual-ci-java-test-vectors: permissions: contents: read + pull-requests: write uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{ inputs.dafny }} @@ -55,6 +60,7 @@ jobs: manual-ci-java-examples: permissions: contents: read + pull-requests: write uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{ inputs.dafny }} @@ -62,6 +68,7 @@ jobs: manual-ci-net: permissions: contents: read + pull-requests: write uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{ inputs.dafny }} @@ -69,6 +76,7 @@ jobs: manual-ci-rust: permissions: contents: read + pull-requests: write uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{ inputs.dafny }} @@ -76,6 +84,7 @@ jobs: manual-ci-net-test-vectors: permissions: contents: read + pull-requests: write uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{ inputs.dafny }} @@ -83,6 +92,7 @@ jobs: manual-ci-net-examples: permissions: contents: read + pull-requests: write uses: ./.github/workflows/ci_examples_net.yml with: dafny: ${{ inputs.dafny }} diff --git a/.github/workflows/mpl-head.yml b/.github/workflows/mpl-head.yml index a46a20207c..012a6da88d 100644 --- a/.github/workflows/mpl-head.yml +++ b/.github/workflows/mpl-head.yml @@ -10,17 +10,20 @@ jobs: getVersion: permissions: contents: read + pull-requests: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml getVerifyVersion: permissions: contents: read + pull-requests: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_verify_version.yml getMplHeadVersion: permissions: contents: read + pull-requests: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/mpl_head_version.yml with: @@ -28,6 +31,7 @@ jobs: mpl-head-ci-format: permissions: contents: read + pull-requests: write needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml @@ -36,6 +40,7 @@ jobs: mpl-head-ci-verification: permissions: contents: read + pull-requests: write needs: [getVerifyVersion, getMplHeadVersion] if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -46,6 +51,7 @@ jobs: mpl-head-ci-test-vector-verification: permissions: contents: read + pull-requests: write needs: [getVerifyVersion, getMplHeadVersion] uses: ./.github/workflows/test_vector_verification.yml with: @@ -55,6 +61,7 @@ jobs: mpl-head-ci-java: permissions: contents: read + pull-requests: write needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_test_java.yml with: @@ -64,6 +71,7 @@ jobs: mpl-head-ci-java-test-vectors: permissions: contents: read + pull-requests: write needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -73,6 +81,7 @@ jobs: mpl-head-ci-java-examples: permissions: contents: read + pull-requests: write needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_examples_java.yml with: @@ -82,6 +91,7 @@ jobs: mpl-head-ci-net: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: @@ -90,6 +100,7 @@ jobs: mpl-head-ci-rust: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: @@ -98,6 +109,7 @@ jobs: mpl-head-ci-net-test-vectors: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: @@ -106,6 +118,7 @@ jobs: mpl-head-ci-net-examples: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: diff --git a/.github/workflows/mpl_dependency_java_version.yml b/.github/workflows/mpl_dependency_java_version.yml index 9a98e24622..b40aff2006 100644 --- a/.github/workflows/mpl_dependency_java_version.yml +++ b/.github/workflows/mpl_dependency_java_version.yml @@ -14,6 +14,7 @@ jobs: getMplDependencyJavaVersion: permissions: contents: read + pull-requests: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.mplDependencyJavaVersion }} diff --git a/.github/workflows/mpl_head_version.yml b/.github/workflows/mpl_head_version.yml index 6dbc00f392..270b4ed014 100644 --- a/.github/workflows/mpl_head_version.yml +++ b/.github/workflows/mpl_head_version.yml @@ -20,6 +20,7 @@ jobs: getMplHeadVersion: permissions: contents: read + pull-requests: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.mplVersion }} diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index c205c2ca57..b9b961da37 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -14,10 +14,12 @@ jobs: getVersion: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_version.yml dafny-nightly-format: permissions: contents: read + pull-requests: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml @@ -27,6 +29,7 @@ jobs: dafny-nightly-verification: permissions: contents: read + pull-requests: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -36,6 +39,7 @@ jobs: dafny-nightly-test-vector-verification: permissions: contents: read + pull-requests: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/test_vector_verification.yml @@ -45,6 +49,7 @@ jobs: dafny-nightly-java: permissions: contents: read + pull-requests: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_java.yml with: @@ -53,6 +58,7 @@ jobs: dafny-nightly-test-vectors-java: permissions: contents: read + pull-requests: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -61,6 +67,7 @@ jobs: dafny-nightly-net: permissions: contents: read + pull-requests: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_net.yml with: @@ -69,6 +76,7 @@ jobs: dafny-nightly-rust: permissions: contents: read + pull-requests: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_rust_tests.yml with: @@ -77,6 +85,7 @@ jobs: dafny-nightly-test-vectors-net: permissions: contents: read + pull-requests: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_vector_net.yml with: diff --git a/.github/workflows/non-prod.yml b/.github/workflows/non-prod.yml index ab2a6f8acf..2af2cdb6f6 100644 --- a/.github/workflows/non-prod.yml +++ b/.github/workflows/non-prod.yml @@ -17,10 +17,12 @@ jobs: getVersion: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_version.yml pr-ci-go: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_go.yml with: @@ -28,6 +30,7 @@ jobs: pr-ci-all-required: permissions: contents: read + pull-requests: write if: always() needs: - getVersion diff --git a/.github/workflows/performance-benchmarks.yml b/.github/workflows/performance-benchmarks.yml index b313b0cd84..b8d711d7c1 100644 --- a/.github/workflows/performance-benchmarks.yml +++ b/.github/workflows/performance-benchmarks.yml @@ -16,11 +16,13 @@ jobs: getVersion: permissions: contents: read + pull-requests: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml performance-benchmarks-go: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/performance-benchmarks-go.yml with: @@ -28,6 +30,7 @@ jobs: performance-benchmarks-rust: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/performance-benchmarks-rust.yml with: @@ -35,6 +38,7 @@ jobs: notify: permissions: contents: read + pull-requests: write needs: [getVersion, performance-benchmarks-go, performance-benchmarks-rust] if: ${{ failure() }} uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml index caa2f59596..ae0da11682 100644 --- a/.github/workflows/pull.yml +++ b/.github/workflows/pull.yml @@ -12,14 +12,17 @@ jobs: getVersion: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_version.yml getVerifyVersion: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_verify_version.yml pr-ci-format: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/library_format.yml with: @@ -27,6 +30,7 @@ jobs: pr-ci-codegen: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_codegen.yml with: @@ -34,6 +38,7 @@ jobs: pr-ci-verification: permissions: contents: read + pull-requests: write needs: getVerifyVersion uses: ./.github/workflows/library_dafny_verification.yml with: @@ -41,6 +46,7 @@ jobs: pr-ci-test-vector-verification: permissions: contents: read + pull-requests: write needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: @@ -48,6 +54,7 @@ jobs: pr-ci-java: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: @@ -55,6 +62,7 @@ jobs: pr-ci-java-test-vectors: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -62,6 +70,7 @@ jobs: pr-ci-java-examples: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: @@ -69,6 +78,7 @@ jobs: pr-ci-net: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: @@ -76,6 +86,7 @@ jobs: pr-ci-rust: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: @@ -83,6 +94,7 @@ jobs: pr-ci-net-test-vectors: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: @@ -90,6 +102,7 @@ jobs: pr-ci-net-examples: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: @@ -97,6 +110,7 @@ jobs: pr-ci-all-required: permissions: contents: read + pull-requests: write if: always() needs: - getVersion diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index cb70a25af0..6005a12350 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -14,14 +14,17 @@ jobs: getVersion: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_version.yml getVerifyVersion: permissions: contents: read + pull-requests: write uses: ./.github/workflows/dafny_verify_version.yml push-ci-format: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/library_format.yml with: @@ -29,6 +32,7 @@ jobs: push-ci-codegen: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_codegen.yml with: @@ -36,6 +40,7 @@ jobs: push-ci-verification: permissions: contents: read + pull-requests: write needs: getVerifyVersion uses: ./.github/workflows/library_dafny_verification.yml with: @@ -43,6 +48,7 @@ jobs: push-ci-test-vector-verification: permissions: contents: read + pull-requests: write needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: @@ -50,6 +56,7 @@ jobs: pr-ci-java: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: @@ -57,6 +64,7 @@ jobs: pr-ci-java-test-vectors: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -64,6 +72,7 @@ jobs: pr-ci-java-examples: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: @@ -71,6 +80,7 @@ jobs: pr-ci-net: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: @@ -78,6 +88,7 @@ jobs: pr-ci-rust: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: @@ -85,6 +96,7 @@ jobs: pr-ci-net-test-vectors: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: @@ -92,6 +104,7 @@ jobs: pr-ci-net-examples: permissions: contents: read + pull-requests: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: diff --git a/.github/workflows/test_vector_verification.yml b/.github/workflows/test_vector_verification.yml index c353b62af2..d0c61db0e6 100644 --- a/.github/workflows/test_vector_verification.yml +++ b/.github/workflows/test_vector_verification.yml @@ -27,6 +27,7 @@ jobs: verification: permissions: contents: read + pull-requests: write # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: From 69e9d34f16899c5efba87dd216d4ed87b49848a5 Mon Sep 17 00:00:00 2001 From: texastony <5892063+texastony@users.noreply.github.com> Date: Mon, 16 Mar 2026 10:47:47 -0700 Subject: [PATCH 3/4] chore: add id-token: write to new job-level permissions --- .github/workflows/ci_codegen.yml | 1 + .github/workflows/ci_duvet.yml | 1 + .github/workflows/ci_static_analysis.yml | 1 + .github/workflows/ci_todos.yml | 1 + .github/workflows/dafny-interop.yml | 7 +++++++ .github/workflows/dafny_verify_version.yml | 1 + .github/workflows/dafny_version.yml | 1 + .github/workflows/daily_ci.yml | 14 ++++++++++++++ .github/workflows/go-release.yml | 1 + .github/workflows/issue-notification.yml | 2 ++ .github/workflows/library_dafny_verification.yml | 1 + .github/workflows/library_format.yml | 1 + .github/workflows/manual.yml | 10 ++++++++++ .github/workflows/mpl-head.yml | 13 +++++++++++++ .github/workflows/mpl_dependency_java_version.yml | 1 + .github/workflows/mpl_head_version.yml | 1 + .github/workflows/nightly.yml | 9 +++++++++ .github/workflows/non-prod.yml | 3 +++ .github/workflows/performance-benchmarks.yml | 4 ++++ .github/workflows/pull.yml | 14 ++++++++++++++ .github/workflows/push.yml | 13 +++++++++++++ .github/workflows/test_vector_verification.yml | 1 + 22 files changed, 101 insertions(+) diff --git a/.github/workflows/ci_codegen.yml b/.github/workflows/ci_codegen.yml index 58b432ed2e..1f657b4cad 100644 --- a/.github/workflows/ci_codegen.yml +++ b/.github/workflows/ci_codegen.yml @@ -13,6 +13,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write strategy: fail-fast: false matrix: diff --git a/.github/workflows/ci_duvet.yml b/.github/workflows/ci_duvet.yml index cae309ba86..286209426f 100644 --- a/.github/workflows/ci_duvet.yml +++ b/.github/workflows/ci_duvet.yml @@ -14,6 +14,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/ci_static_analysis.yml b/.github/workflows/ci_static_analysis.yml index db70f2062f..97abdd51a7 100644 --- a/.github/workflows/ci_static_analysis.yml +++ b/.github/workflows/ci_static_analysis.yml @@ -12,6 +12,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/ci_todos.yml b/.github/workflows/ci_todos.yml index d2f1f343a2..3e3e0abbb2 100644 --- a/.github/workflows/ci_todos.yml +++ b/.github/workflows/ci_todos.yml @@ -12,6 +12,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write runs-on: macos-14 steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/dafny-interop.yml b/.github/workflows/dafny-interop.yml index da222c2d06..fc1053d432 100644 --- a/.github/workflows/dafny-interop.yml +++ b/.github/workflows/dafny-interop.yml @@ -25,6 +25,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/mpl_head_version.yml with: mpl-head: ${{inputs.mpl-commit}} @@ -32,6 +33,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_java.yml with: @@ -43,6 +45,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_test_vector_java.yml with: @@ -54,6 +57,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getMplHeadVersion uses: ./.github/workflows/dafny_interop_examples_java.yml with: @@ -65,6 +69,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_interop_test_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} @@ -74,6 +79,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_interop_test_vector_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} @@ -83,6 +89,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_interop_examples_net.yml with: mpl-dafny: ${{inputs.mpl-dafny}} diff --git a/.github/workflows/dafny_verify_version.yml b/.github/workflows/dafny_verify_version.yml index 590207ae9f..a35989ca5c 100644 --- a/.github/workflows/dafny_verify_version.yml +++ b/.github/workflows/dafny_verify_version.yml @@ -15,6 +15,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.dafnyVerifyVersion }} diff --git a/.github/workflows/dafny_version.yml b/.github/workflows/dafny_version.yml index fc1248e288..a6e328ab8a 100644 --- a/.github/workflows/dafny_version.yml +++ b/.github/workflows/dafny_version.yml @@ -15,6 +15,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.dafnyVersion }} diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml index 02582b84c4..2bd30ceb82 100644 --- a/.github/workflows/daily_ci.yml +++ b/.github/workflows/daily_ci.yml @@ -16,6 +16,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml @@ -23,12 +24,14 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_verify_version.yml daily-ci-format: permissions: contents: read pull-requests: write + id-token: write needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml @@ -38,6 +41,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_codegen.yml @@ -47,6 +51,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVerifyVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -56,6 +61,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: @@ -64,6 +70,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: @@ -72,6 +79,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -80,6 +88,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: @@ -88,6 +97,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: @@ -96,6 +106,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: @@ -104,6 +115,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: @@ -112,6 +124,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: @@ -120,6 +133,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: [ getVersion, diff --git a/.github/workflows/go-release.yml b/.github/workflows/go-release.yml index 1b6750aa36..5dc08e5b5b 100644 --- a/.github/workflows/go-release.yml +++ b/.github/workflows/go-release.yml @@ -17,6 +17,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml go-release: diff --git a/.github/workflows/issue-notification.yml b/.github/workflows/issue-notification.yml index d86501d0e6..0f80724323 100644 --- a/.github/workflows/issue-notification.yml +++ b/.github/workflows/issue-notification.yml @@ -10,6 +10,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name == 'issues' uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: @@ -21,6 +22,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name == 'issue_comment' && !github.event.issue.pull_request uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: diff --git a/.github/workflows/library_dafny_verification.yml b/.github/workflows/library_dafny_verification.yml index e432481a9a..42dd90006d 100644 --- a/.github/workflows/library_dafny_verification.yml +++ b/.github/workflows/library_dafny_verification.yml @@ -28,6 +28,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: diff --git a/.github/workflows/library_format.yml b/.github/workflows/library_format.yml index 630a27f99e..dad0a191f6 100644 --- a/.github/workflows/library_format.yml +++ b/.github/workflows/library_format.yml @@ -18,6 +18,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml index 7c00bf64c5..9e01f79f24 100644 --- a/.github/workflows/manual.yml +++ b/.github/workflows/manual.yml @@ -21,6 +21,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/library_format.yml with: dafny: ${{ inputs.dafny }} @@ -29,6 +30,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/library_dafny_verification.yml with: dafny: ${{ inputs.dafny }} @@ -37,6 +39,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/test_vector_verification.yml with: dafny: ${{ inputs.dafny }} @@ -45,6 +48,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/ci_test_java.yml with: dafny: ${{ inputs.dafny }} @@ -53,6 +57,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/ci_test_vector_java.yml with: dafny: ${{ inputs.dafny }} @@ -61,6 +66,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/ci_examples_java.yml with: dafny: ${{ inputs.dafny }} @@ -69,6 +75,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/ci_test_net.yml with: dafny: ${{ inputs.dafny }} @@ -77,6 +84,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/library_rust_tests.yml with: dafny: ${{ inputs.dafny }} @@ -85,6 +93,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/ci_test_vector_net.yml with: dafny: ${{ inputs.dafny }} @@ -93,6 +102,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/ci_examples_net.yml with: dafny: ${{ inputs.dafny }} diff --git a/.github/workflows/mpl-head.yml b/.github/workflows/mpl-head.yml index 012a6da88d..278a570f42 100644 --- a/.github/workflows/mpl-head.yml +++ b/.github/workflows/mpl-head.yml @@ -11,6 +11,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml @@ -18,12 +19,14 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_verify_version.yml getMplHeadVersion: permissions: contents: read pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/mpl_head_version.yml with: @@ -32,6 +35,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml @@ -41,6 +45,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: [getVerifyVersion, getMplHeadVersion] if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -52,6 +57,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: [getVerifyVersion, getMplHeadVersion] uses: ./.github/workflows/test_vector_verification.yml with: @@ -62,6 +68,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_test_java.yml with: @@ -72,6 +79,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -82,6 +90,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: [getVersion, getMplHeadVersion] uses: ./.github/workflows/ci_examples_java.yml with: @@ -92,6 +101,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: @@ -101,6 +111,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: @@ -110,6 +121,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: @@ -119,6 +131,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: diff --git a/.github/workflows/mpl_dependency_java_version.yml b/.github/workflows/mpl_dependency_java_version.yml index b40aff2006..da41e7de9b 100644 --- a/.github/workflows/mpl_dependency_java_version.yml +++ b/.github/workflows/mpl_dependency_java_version.yml @@ -15,6 +15,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.mplDependencyJavaVersion }} diff --git a/.github/workflows/mpl_head_version.yml b/.github/workflows/mpl_head_version.yml index 270b4ed014..eef4327d02 100644 --- a/.github/workflows/mpl_head_version.yml +++ b/.github/workflows/mpl_head_version.yml @@ -21,6 +21,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write runs-on: ubuntu-22.04 outputs: version: ${{ steps.read_property.outputs.mplVersion }} diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index b9b961da37..8276f9b3d4 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -15,11 +15,13 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml dafny-nightly-format: permissions: contents: read pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_format.yml @@ -30,6 +32,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_dafny_verification.yml @@ -40,6 +43,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write # Don't run the cron builds on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/test_vector_verification.yml @@ -50,6 +54,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_java.yml with: @@ -59,6 +64,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -68,6 +74,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_net.yml with: @@ -77,6 +84,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/library_rust_tests.yml with: @@ -86,6 +94,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/ci_test_vector_net.yml with: diff --git a/.github/workflows/non-prod.yml b/.github/workflows/non-prod.yml index 2af2cdb6f6..083bdff945 100644 --- a/.github/workflows/non-prod.yml +++ b/.github/workflows/non-prod.yml @@ -18,11 +18,13 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml pr-ci-go: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_go.yml with: @@ -31,6 +33,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: always() needs: - getVersion diff --git a/.github/workflows/performance-benchmarks.yml b/.github/workflows/performance-benchmarks.yml index b8d711d7c1..7c956369a3 100644 --- a/.github/workflows/performance-benchmarks.yml +++ b/.github/workflows/performance-benchmarks.yml @@ -17,12 +17,14 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: github.event_name != 'schedule' || github.repository_owner == 'aws' uses: ./.github/workflows/dafny_version.yml performance-benchmarks-go: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/performance-benchmarks-go.yml with: @@ -31,6 +33,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/performance-benchmarks-rust.yml with: @@ -39,6 +42,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: [getVersion, performance-benchmarks-go, performance-benchmarks-rust] if: ${{ failure() }} uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml index ae0da11682..47ba389b17 100644 --- a/.github/workflows/pull.yml +++ b/.github/workflows/pull.yml @@ -13,16 +13,19 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml getVerifyVersion: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_verify_version.yml pr-ci-format: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_format.yml with: @@ -31,6 +34,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_codegen.yml with: @@ -39,6 +43,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/library_dafny_verification.yml with: @@ -47,6 +52,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: @@ -55,6 +61,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: @@ -63,6 +70,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -71,6 +79,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: @@ -79,6 +88,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: @@ -87,6 +97,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: @@ -95,6 +106,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: @@ -103,6 +115,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: @@ -111,6 +124,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write if: always() needs: - getVersion diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 6005a12350..07f40bd0df 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -15,16 +15,19 @@ jobs: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_version.yml getVerifyVersion: permissions: contents: read pull-requests: write + id-token: write uses: ./.github/workflows/dafny_verify_version.yml push-ci-format: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_format.yml with: @@ -33,6 +36,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_codegen.yml with: @@ -41,6 +45,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/library_dafny_verification.yml with: @@ -49,6 +54,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVerifyVersion uses: ./.github/workflows/test_vector_verification.yml with: @@ -57,6 +63,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_java.yml with: @@ -65,6 +72,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_java.yml with: @@ -73,6 +81,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_java.yml with: @@ -81,6 +90,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_net.yml with: @@ -89,6 +99,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/library_rust_tests.yml with: @@ -97,6 +108,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_test_vector_net.yml with: @@ -105,6 +117,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write needs: getVersion uses: ./.github/workflows/ci_examples_net.yml with: diff --git a/.github/workflows/test_vector_verification.yml b/.github/workflows/test_vector_verification.yml index d0c61db0e6..006b107cf1 100644 --- a/.github/workflows/test_vector_verification.yml +++ b/.github/workflows/test_vector_verification.yml @@ -28,6 +28,7 @@ jobs: permissions: contents: read pull-requests: write + id-token: write # Don't run the nightly build on forks if: github.event_name != 'schedule' || github.repository_owner == 'aws' strategy: From cefdabfad2f1b48feef2b9e281627990a2278709 Mon Sep 17 00:00:00 2001 From: Tony Knapp <5892063+texastony@users.noreply.github.com> Date: Mon, 16 Mar 2026 12:36:52 -0700 Subject: [PATCH 4/4] Update .github/workflows/daily_ci.yml Co-authored-by: Rishav karanjit --- .github/workflows/daily_ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml index 2bd30ceb82..0f4489f2d0 100644 --- a/.github/workflows/daily_ci.yml +++ b/.github/workflows/daily_ci.yml @@ -150,7 +150,7 @@ jobs: daily-ci-net-test-vectors, daily-ci-net-examples, ] - if: ${{ failure() }} + if: ${{ failure() && github.event_name == 'schedule'}} uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main with: message: "Daily CI failed on `${{ github.repository }}`. View run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"