Configure Actions permissions for build runs (#8)

PostHog · Feb 7, 2024 · 49fa92b · 49fa92b
1 parent 017ae03
commit 49fa92b
Show file tree

Hide file tree

Showing 5 changed files with 25 additions and 0 deletions.
diff --git a/.github/workflows/docker-capture.yml b/.github/workflows/docker-capture.yml
@@ -13,6 +13,11 @@ jobs:
   build:
     name: build and publish capture image
     runs-on: buildjet-4vcpu-ubuntu-2204-arm
+    permissions:
+      id-token: write # allow issuing OIDC tokens for this workflow run
+      contents: read # allow reading the repo contents
+      packages: write # allow push to ghcr.io
+
     steps:
       - name: Check Out Repo
         uses: actions/checkout@v3

diff --git a/.github/workflows/docker-hook-api.yml b/.github/workflows/docker-hook-api.yml
@@ -13,6 +13,11 @@ jobs:
   build:
     name: build and publish hook-api image
     runs-on: buildjet-4vcpu-ubuntu-2204-arm
+    permissions:
+      id-token: write # allow issuing OIDC tokens for this workflow run
+      contents: read # allow reading the repo contents
+      packages: write # allow push to ghcr.io
+
     steps:
       - name: Check Out Repo
         uses: actions/checkout@v3

diff --git a/.github/workflows/docker-hook-janitor.yml b/.github/workflows/docker-hook-janitor.yml
@@ -13,6 +13,11 @@ jobs:
   build:
     name: build and publish hook-janitor image
     runs-on: buildjet-4vcpu-ubuntu-2204-arm
+    permissions:
+      id-token: write # allow issuing OIDC tokens for this workflow run
+      contents: read # allow reading the repo contents
+      packages: write # allow push to ghcr.io
+
     steps:
       - name: Check Out Repo
         uses: actions/checkout@v3

diff --git a/.github/workflows/docker-hook-worker.yml b/.github/workflows/docker-hook-worker.yml
@@ -13,6 +13,11 @@ jobs:
   build:
     name: build and publish hook-worker image
     runs-on: buildjet-4vcpu-ubuntu-2204-arm
+    permissions:
+      id-token: write # allow issuing OIDC tokens for this workflow run
+      contents: read # allow reading the repo contents
+      packages: write # allow push to ghcr.io
+
     steps:
       - name: Check Out Repo
         uses: actions/checkout@v3

diff --git a/.github/workflows/docker-migrator.yml b/.github/workflows/docker-migrator.yml
@@ -13,6 +13,11 @@ jobs:
   build:
     name: build and publish hook-migrator image
     runs-on: buildjet-4vcpu-ubuntu-2204-arm
+    permissions:
+      id-token: write # allow issuing OIDC tokens for this workflow run
+      contents: read # allow reading the repo contents
+      packages: write # allow push to ghcr.io
+
     steps:
       - name: Check Out Repo
         uses: actions/checkout@v3