Add extra read permissions

Signed-off-by: Mauro Morales <[email protected]>
kairos-io · Jun 28, 2024 · 241263d · 241263d
1 parent f6c7c08
commit 241263d
Show file tree

Hide file tree

Showing 4 changed files with 77 additions and 6 deletions.
diff --git a/.github/workflows/image-arm.yaml b/.github/workflows/image-arm.yaml
@@ -173,8 +173,18 @@ jobs:
     permissions:
       id-token: write  # OIDC support
       contents: write
-      actions: read
       security-events: write
+      actions: read
+      attestations: read
+      checks: read
+      deployments: read
+      discussions: read
+      issues: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     needs: build-nvidia-base
     secrets: inherit
     with:
@@ -190,8 +200,18 @@ jobs:
     permissions:
       id-token: write  # OIDC support
       contents: write
-      actions: read
       security-events: write
+      actions: read
+      attestations: read
+      checks: read
+      deployments: read
+      discussions: read
+      issues: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     secrets: inherit
     with:
       flavor: ${{ matrix.flavor }}

diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml
@@ -39,8 +39,18 @@ jobs:
     permissions:
       id-token: write  # OIDC support
       contents: write
-      actions: read
       security-events: write
+      actions: read
+      attestations: read
+      checks: read
+      deployments: read
+      discussions: read
+      issues: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     secrets: inherit
     with:
       flavor: ${{ matrix.flavor }}
@@ -276,7 +286,18 @@ jobs:
     permissions:
       id-token: write  # OIDC support
       contents: write
+      security-events: write
       actions: read
+      attestations: read
+      checks: read
+      deployments: read
+      discussions: read
+      issues: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     secrets: inherit
     with:
       flavor: ${{ matrix.flavor }}

diff --git a/.github/workflows/release-arm.yaml b/.github/workflows/release-arm.yaml
@@ -145,8 +145,18 @@ jobs:
     permissions:
       id-token: write  # OIDC support
       contents: write
-      actions: read
       security-events: write
+      actions: read
+      attestations: read
+      checks: read
+      deployments: read
+      discussions: read
+      issues: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     needs: build-nvidia-base
     secrets: inherit
     with:

diff --git a/.github/workflows/uki_branches.yaml b/.github/workflows/uki_branches.yaml
@@ -25,8 +25,18 @@ jobs:
     permissions:
       id-token: write  # OIDC support
       contents: write
-      actions: read
       security-events: write
+      actions: read
+      attestations: read
+      checks: read
+      deployments: read
+      discussions: read
+      issues: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     with:
       base_image: ubuntu:24.04
       family: ubuntu
@@ -37,8 +47,18 @@ jobs:
     permissions:
       id-token: write  # OIDC support
       contents: write
-      actions: read
       security-events: write
+      actions: read
+      attestations: read
+      checks: read
+      deployments: read
+      discussions: read
+      issues: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     with:
       base_image: fedora:40
       family: rhel