ci: Add id-token: write permission to reusable worflow callers

Techassi · Techassi · commit b5c10fe1b333 · 2026-04-07T13:06:59.000+02:00
diff --git a/.github/workflows/build_airflow.yaml b/.github/workflows/build_airflow.yaml
@@ -32,6 +32,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: airflow
diff --git a/.github/workflows/build_druid.yaml b/.github/workflows/build_druid.yaml
@@ -34,6 +34,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: druid
diff --git a/.github/workflows/build_hadoop.yaml b/.github/workflows/build_hadoop.yaml
@@ -34,6 +34,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: hadoop
diff --git a/.github/workflows/build_hbase.yaml b/.github/workflows/build_hbase.yaml
@@ -35,6 +35,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: hbase
diff --git a/.github/workflows/build_hive.yaml b/.github/workflows/build_hive.yaml
@@ -35,6 +35,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: hive
diff --git a/.github/workflows/build_java-base.yaml b/.github/workflows/build_java-base.yaml
@@ -30,6 +30,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: java-base
diff --git a/.github/workflows/build_java-devel.yaml b/.github/workflows/build_java-devel.yaml
@@ -30,6 +30,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: java-devel
diff --git a/.github/workflows/build_kafka-testing-tools.yaml b/.github/workflows/build_kafka-testing-tools.yaml
@@ -34,6 +34,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: kafka-testing-tools
diff --git a/.github/workflows/build_kafka.yaml b/.github/workflows/build_kafka.yaml
@@ -35,6 +35,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: kafka
diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
@@ -30,6 +30,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: krb5
diff --git a/.github/workflows/build_nifi.yaml b/.github/workflows/build_nifi.yaml
@@ -34,6 +34,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: nifi
diff --git a/.github/workflows/build_omid.yaml b/.github/workflows/build_omid.yaml
@@ -34,6 +34,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: omid
diff --git a/.github/workflows/build_opa.yaml b/.github/workflows/build_opa.yaml
@@ -32,6 +32,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: opa
diff --git a/.github/workflows/build_opensearch.yaml b/.github/workflows/build_opensearch.yaml
@@ -35,6 +35,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: opensearch
diff --git a/.github/workflows/build_opensearch_dashboards.yaml b/.github/workflows/build_opensearch_dashboards.yaml
@@ -33,6 +33,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: opensearch-dashboards
diff --git a/.github/workflows/build_spark-connect-client.yaml b/.github/workflows/build_spark-connect-client.yaml
@@ -33,6 +33,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: spark-connect-client
diff --git a/.github/workflows/build_spark-k8s.yaml b/.github/workflows/build_spark-k8s.yaml
@@ -35,6 +35,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: spark-k8s
diff --git a/.github/workflows/build_stackable-base.yaml b/.github/workflows/build_stackable-base.yaml
@@ -31,6 +31,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: stackable-base
diff --git a/.github/workflows/build_superset.yaml b/.github/workflows/build_superset.yaml
@@ -32,6 +32,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: superset
diff --git a/.github/workflows/build_testing-tools.yaml b/.github/workflows/build_testing-tools.yaml
@@ -38,6 +38,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: ${{ matrix.product-name }}
diff --git a/.github/workflows/build_tools.yaml b/.github/workflows/build_tools.yaml
@@ -31,6 +31,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: tools
diff --git a/.github/workflows/build_trino-cli.yaml b/.github/workflows/build_trino-cli.yaml
@@ -33,6 +33,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: trino-cli
diff --git a/.github/workflows/build_trino.yaml b/.github/workflows/build_trino.yaml
@@ -34,6 +34,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: trino
diff --git a/.github/workflows/build_vector.yaml b/.github/workflows/build_vector.yaml
@@ -30,6 +30,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: vector
diff --git a/.github/workflows/build_zookeeper.yaml b/.github/workflows/build_zookeeper.yaml
@@ -34,6 +34,7 @@ jobs:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
     permissions:
+      id-token: write
       contents: read
     with:
       product-name: zookeeper
