added explicit permissions to ci (#146)

redhat-cop · Dec 14, 2023 · ee4b466 · ee4b466
1 parent 2bbe326
commit ee4b466
Show file tree

Hide file tree

Showing 13 changed files with 42 additions and 2 deletions.
diff --git a/.github/workflows/confbatstest-build.yaml b/.github/workflows/confbatstest-build.yaml
@@ -6,10 +6,12 @@ on:
       - .github/workflows/confbatstest-build.yaml
       - confbatstest/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build-confbatstest:
     permissions:
-      contents: read
       packages: write
     env:
       context: confbatstest
@@ -63,7 +65,6 @@ jobs:
   sign-confbatstest:
     needs: [build-confbatstest]
     permissions:
-      contents: read
       id-token: write
       packages: write
     if: ${{ github.ref_type == 'tag' || github.repository_owner != 'redhat-cop' }} # Stops push running when bots create a PR, which fails due to token

diff --git a/.github/workflows/confbatstest.yaml b/.github/workflows/confbatstest.yaml
@@ -10,6 +10,9 @@ on:
       - .github/workflows/confbatstest.yaml
       - confbatstest/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   conftest:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/disconnected-csv.yaml b/.github/workflows/disconnected-csv.yaml
@@ -10,6 +10,9 @@ on:
       - disconnected-csv/**
       - .github/workflows/disconnected-csv.yaml
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   disconnected-csv:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/get-image-version.yaml b/.github/workflows/get-image-version.yaml
@@ -10,6 +10,9 @@ on:
       - .github/workflows/get-image-version.yaml
       - get-image-version/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   get-image-version:
     env:

diff --git a/.github/workflows/github-dispatches-build.yaml b/.github/workflows/github-dispatches-build.yaml
@@ -6,6 +6,9 @@ on:
       - .github/workflows/github-dispatches-build.yaml
       - github-dispatches/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build-github-dispatches:
     env:
@@ -15,6 +18,8 @@ jobs:
       ref_type: ${{ github.ref_type }}
       owner: ${{ github.repository_owner }}
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

diff --git a/.github/workflows/github-dispatches.yaml b/.github/workflows/github-dispatches.yaml
@@ -10,6 +10,9 @@ on:
       - .github/workflows/github-dispatches.yaml
       - github-dispatches/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   github-dispatches:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/kyverno-cli-build.yaml b/.github/workflows/kyverno-cli-build.yaml
@@ -6,6 +6,9 @@ on:
       - .github/workflows/kyverno-cli-build.yaml
       - kyverno-cli/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build-kyverno-cli:
     env:
@@ -15,6 +18,8 @@ jobs:
       ref_type: ${{ github.ref_type }}
       owner: ${{ github.repository_owner }}
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

diff --git a/.github/workflows/kyverno-cli.yaml b/.github/workflows/kyverno-cli.yaml
@@ -10,6 +10,9 @@ on:
       - .github/workflows/kyverno-cli.yaml
       - kyverno-cli/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   kyverno-cli:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/redhat-csp-download-build.yaml b/.github/workflows/redhat-csp-download-build.yaml
@@ -15,6 +15,8 @@ jobs:
       ref_type: ${{ github.ref_type }}
       owner: ${{ github.repository_owner }}
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

diff --git a/.github/workflows/redhat-csp-download.yaml b/.github/workflows/redhat-csp-download.yaml
@@ -10,6 +10,9 @@ on:
       - .github/workflows/redhat-csp-download.yaml
       - redhat-csp-download/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   redhat-csp-download:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/set-helm-version.yaml b/.github/workflows/set-helm-version.yaml
@@ -10,6 +10,9 @@ on:
       - .github/workflows/set-helm-version.yaml
       - set-helm-version/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   set-helm-version:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/ssh-agent-build.yaml b/.github/workflows/ssh-agent-build.yaml
@@ -10,6 +10,9 @@ on:
       - .github/workflows/ssh-agent-build.yaml
       - ssh-agent/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/ssh-agent.yaml b/.github/workflows/ssh-agent.yaml
@@ -10,6 +10,9 @@ on:
       - .github/workflows/ssh-agent.yaml
       - ssh-agent/**
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   ssh-agent:
     runs-on: ubuntu-latest