Skip to content

Commit 1becf85

Browse files
cwize1cwize1
committed
Fix workflow permissions
1 parent 36b1c03 commit 1becf85

18 files changed

Lines changed: 113 additions & 59 deletions

‎.github/workflows/binary-build.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@
33

44
name: Build binary and container for single arch
55

6-
permissions:
7-
contents: read
6+
permissions: {}
87

98
on:
109
workflow_call:

‎.github/workflows/build-dev.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@
33

44
name: Build (dev)
55

6-
permissions:
7-
contents: read
8-
# Azure login.
9-
id-token: write
6+
permissions: {}
107

118
on:
129
pull_request:
@@ -30,6 +27,10 @@ on:
3027
jobs:
3128
build:
3229
uses: ./.github/workflows/build.yml
30+
permissions:
31+
contents: read
32+
# Azure login.
33+
id-token: write
3334
with:
3435
publishType: dev
3536
runFunctionalTests: ${{ inputs.runFunctionalTests || false }}

‎.github/workflows/build-main.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@
33

44
name: Build (main)
55

6-
permissions:
7-
contents: read
8-
# Azure login.
9-
id-token: write
6+
permissions: {}
107

118
on:
129
push:
@@ -16,6 +13,10 @@ on:
1613
jobs:
1714
build:
1815
uses: ./.github/workflows/build.yml
16+
permissions:
17+
contents: read
18+
# Azure login.
19+
id-token: write
1920
with:
2021
publishType: main
2122
runFunctionalTests: true

‎.github/workflows/build-preview.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@
33

44
name: Build (preview)
55

6-
permissions:
7-
contents: read
8-
# Azure login.
9-
id-token: write
6+
permissions: {}
107

118
on:
129
push:
@@ -16,6 +13,10 @@ on:
1613
jobs:
1714
build:
1815
uses: ./.github/workflows/build.yml
16+
permissions:
17+
contents: read
18+
# Azure login.
19+
id-token: write
1920
with:
2021
publishType: preview
2122
runFunctionalTests: true

‎.github/workflows/build.yml‎

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@
33

44
name: Build binary, container, and docs
55

6-
permissions:
7-
contents: read
8-
# Azure login.
9-
id-token: write
6+
permissions: {}
107

118
on:
129
workflow_call:
@@ -28,13 +25,17 @@ jobs:
2825
binary-build-amd64:
2926
name: Build AMD64
3027
uses: ./.github/workflows/binary-build.yml
28+
permissions:
29+
contents: read
3130
with:
3231
publishType: ${{ inputs.publishType }}
3332
arch: amd64
3433

3534
binary-build-arm64:
3635
name: Build ARM64
3736
uses: ./.github/workflows/binary-build.yml
37+
permissions:
38+
contents: read
3839
with:
3940
publishType: ${{ inputs.publishType }}
4041
arch: arm64
@@ -46,6 +47,10 @@ jobs:
4647
name: Functional tests AZL3 AMD64
4748
if: ${{ inputs.runFunctionalTests }}
4849
uses: ./.github/workflows/tests-functional.yml
50+
permissions:
51+
contents: read
52+
# Azure login.
53+
id-token: write
4954
with:
5055
hostArch: amd64
5156
hostDistro: azl3
@@ -54,6 +59,10 @@ jobs:
5459
name: Functional tests AZL3 ARM64
5560
if: ${{ inputs.runFunctionalTests }}
5661
uses: ./.github/workflows/tests-functional.yml
62+
permissions:
63+
contents: read
64+
# Azure login.
65+
id-token: write
5766
with:
5867
hostArch: arm64
5968
hostDistro: azl3
@@ -62,6 +71,10 @@ jobs:
6271
name: Functional tests Ubuntu24.04 AMD64
6372
if: ${{ inputs.runFunctionalTests }}
6473
uses: ./.github/workflows/tests-functional.yml
74+
permissions:
75+
contents: read
76+
# Azure login.
77+
id-token: write
6578
with:
6679
hostArch: amd64
6780
hostDistro: ubuntu2404
@@ -70,6 +83,10 @@ jobs:
7083
name: Functional tests Ubuntu24.04 ARM64
7184
if: ${{ inputs.runFunctionalTests }}
7285
uses: ./.github/workflows/tests-functional.yml
86+
permissions:
87+
contents: read
88+
# Azure login.
89+
id-token: write
7390
with:
7491
hostArch: arm64
7592
hostDistro: ubuntu2404
@@ -95,6 +112,10 @@ jobs:
95112
if: ${{ inputs.runVMTests }}
96113
needs: binary-build-amd64
97114
uses: ./.github/workflows/tests-vmtests.yml
115+
permissions:
116+
contents: read
117+
# Azure login.
118+
id-token: write
98119
with:
99120
hostArch: amd64
100121
hostDistro: azl3
@@ -104,6 +125,10 @@ jobs:
104125
if: ${{ inputs.runVMTests }}
105126
needs: binary-build-amd64
106127
uses: ./.github/workflows/tests-vmtests.yml
128+
permissions:
129+
contents: read
130+
# Azure login.
131+
id-token: write
107132
with:
108133
hostArch: amd64
109134
hostDistro: ubuntu2404
@@ -113,6 +138,8 @@ jobs:
113138
if: ${{ inputs.runVMTests }}
114139
needs: binary-build-arm64
115140
uses: ./.github/workflows/tests-vmtests.yml
141+
permissions:
142+
contents: read
116143
with:
117144
hostArch: arm64
118145
hostDistro: ubuntu2404
@@ -122,6 +149,8 @@ jobs:
122149
if: ${{ inputs.runVMTests }}
123150
needs: binary-build-amd64
124151
uses: ./.github/workflows/tests-vmtests-imagecreator.yml
152+
permissions:
153+
contents: read
125154
with:
126155
hostArch: amd64
127156
hostDistro: azl3
@@ -131,6 +160,8 @@ jobs:
131160
if: ${{ inputs.runVMTests }}
132161
needs: binary-build-amd64
133162
uses: ./.github/workflows/tests-vmtests-imagecreator.yml
163+
permissions:
164+
contents: read
134165
with:
135166
hostArch: amd64
136167
hostDistro: ubuntu2404
@@ -140,6 +171,8 @@ jobs:
140171
if: ${{ inputs.runVMTests }}
141172
needs: binary-build-arm64
142173
uses: ./.github/workflows/tests-vmtests-imagecreator.yml
174+
permissions:
175+
contents: read
143176
with:
144177
hostArch: arm64
145178
hostDistro: ubuntu2404

‎.github/workflows/docs-build.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
name: Build docs
22

3-
permissions:
4-
contents: read
3+
permissions: {}
54

65
on:
76
workflow_call: {}

‎.github/workflows/fork-release-branch.yml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@
33

44
name: Fork release branch
55

6-
permissions:
7-
# Create release branch.
8-
contents: write
6+
permissions: {}
97

108
on:
119
workflow_call: {}

‎.github/workflows/imagecreator-tests-functional.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@
33

44
name: Tests Image Creator functional
55

6-
permissions:
7-
contents: read
6+
permissions: {}
87

98
on:
109
workflow_call:

‎.github/workflows/open-bump-version-pr.yml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,7 @@
33

44
name: Open bump version PR
55

6-
permissions:
7-
# Create release branch and publish release.
8-
contents: write
9-
# Publish PR.
10-
#pull-requests: write
6+
permissions: {}
117

128
on:
139
workflow_call: {}

‎.github/workflows/publish-container.yml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
11
name: Publish container to GHCR
22

3-
permissions:
4-
# "Keyless" container signing
5-
id-token: write
6-
# Publish to GHCR.
7-
packages: write
3+
permissions: {}
84

95
on:
106
workflow_call: {}

0 commit comments

Comments
 (0)