fix: Grant permissions for SLSA provenance job

.github/workflows/build_airflow.yaml

@@ -41,6 +41,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: airflow
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_druid.yaml

@@ -43,6 +43,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: druid
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_hadoop.yaml

@@ -43,6 +43,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: hadoop
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_hbase.yaml

@@ -44,6 +44,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: hbase
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_hive.yaml

@@ -44,6 +44,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: hive
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_java-base.yaml

@@ -39,6 +39,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: java-base
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_java-devel.yaml

@@ -39,6 +39,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: java-devel
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_kafka-testing-tools.yaml

@@ -43,6 +43,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: kafka-testing-tools
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_kafka.yaml

@@ -44,6 +44,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: kafka
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_krb5.yaml

@@ -39,6 +39,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: krb5
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_nifi.yaml

@@ -43,6 +43,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: nifi
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_omid.yaml

@@ -43,6 +43,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: omid
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_opa.yaml

@@ -41,6 +41,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: opa
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_opensearch.yaml

@@ -44,6 +44,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: opensearch
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_opensearch_dashboards.yaml

@@ -42,6 +42,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: opensearch-dashboards
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_spark-connect-client.yaml

@@ -41,6 +41,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: spark-connect-client
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_spark-k8s.yaml

@@ -44,6 +44,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: spark-k8s
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_stackable-base.yaml

@@ -40,6 +40,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: stackable-base
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_superset.yaml

@@ -41,6 +41,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: superset
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_testing-tools.yaml

@@ -47,6 +47,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: ${{ matrix.product-name }}
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_tools.yaml

@@ -40,6 +40,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: tools
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_trino-cli.yaml

@@ -42,6 +42,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: trino-cli
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_trino.yaml

@@ -43,6 +43,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: trino
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_vector.yaml

@@ -39,6 +39,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: vector
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/build_zookeeper.yaml

@@ -43,6 +43,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: zookeeper
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}

.github/workflows/precompile_hadoop.yaml

@@ -45,6 +45,10 @@ jobs:
       id-token: write
       # Needed for checkout
       contents: read
+      # Both needed by the nested SLSA provenance job (see reusable_build_image.yaml);
+      # packages: write is required until slsa-github-generator#1257 is resolved.
+      actions: read
+      packages: write
     with:
       product-name: precompiled/hadoop
       registry-namespace: precompiled