From ff92f7014023509d45406764f8f477edffd768b0 Mon Sep 17 00:00:00 2001 From: Said Sef Date: Sat, 30 Nov 2024 05:16:25 +0000 Subject: [PATCH] fix: workflow permissions --- .github/workflows/charts.yml | 6 +++++- .github/workflows/scorecard.yml | 1 - .github/workflows/stale.yml | 4 ++++ 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/charts.yml b/.github/workflows/charts.yml index ec7c1ac..099b2b9 100644 --- a/.github/workflows/charts.yml +++ b/.github/workflows/charts.yml @@ -23,7 +23,6 @@ jobs: chart: runs-on: ubuntu-latest permissions: - id-token: write pages: write security-events: write contents: write @@ -97,6 +96,11 @@ jobs: with: sarif_file: 'trivy-results.sarif' + dependency-review: + uses: saidsef/saidsef/.github/workflows/dependency-review.yaml@main + if: ${{ github.event_name == 'pull_request' }} + needs: [chart] + k8s-test: runs-on: ubuntu-latest needs: [chart] diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ee9e04a..b59a7f7 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,6 @@ jobs: runs-on: ubuntu-latest permissions: security-events: write - id-token: write steps: - name: "Checkout code" uses: actions/checkout@v4 diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index f6832df..9f7734a 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -3,9 +3,13 @@ on: schedule: - cron: '30 3 * * *' +permissions: read-all + jobs: stale: runs-on: ubuntu-latest + permissions: + issues: write steps: - uses: actions/stale@v9 with: