chore: set default permission for workflows

DevOpsHiveHQ · Sep 17, 2023 · 406d396 · 406d396
1 parent 62e552e
commit 406d396
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 3 deletions.
diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
@@ -26,8 +26,10 @@ jobs:
   build:
     name: Build Artifacts
     permissions:
-      contents: read
       id-token: write
+      contents: write
+      packages: write
+      pull-requests: write
     needs: ["lint"]
     uses: ./.github/workflows/tpl-packaging.yml
     secrets: inherit

diff --git a/.github/workflows/go-pre-release.yml b/.github/workflows/go-pre-release.yml
@@ -13,8 +13,9 @@ jobs:
     name: Pre Release
     runs-on: ubuntu-latest
     permissions:
-      actions: write
+      id-token: write
       contents: write
+      packages: write
       pull-requests: write
     steps:
     - name: Run Release Please

diff --git a/.github/workflows/tpl-packaging.yml b/.github/workflows/tpl-packaging.yml
@@ -22,10 +22,17 @@ on:
         default: dist
         type: string
 
-# The permissions are inherited from the caller workflow.
+permissions:
+  contents: read
+
 jobs:
   run:
     name: Run GoReleaser
+    permissions:
+      id-token: write
+      contents: write
+      packages: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4