ci: add missing permissions to release and schedule

adfinis · Apr 22, 2024 · bb5b700 · bb5b700
1 parent 172519f
commit bb5b700
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -18,7 +18,7 @@ jobs:
       packages: write
       pull-requests: none
       repository-projects: none
-      security-events: none
+      security-events: write # needed to write sarif to security tab
       statuses: none
       id-token: write # needed for signing the images with GitHub OIDC using cosign
     steps:

diff --git a/.github/workflows/schedule.yaml b/.github/workflows/schedule.yaml
@@ -10,6 +10,19 @@ jobs:
   scan-backend:
     name: Scan backend image
     runs-on: ubuntu-latest
+    permissions:
+      actions: none
+      checks: none
+      contents: none
+      deployments: none
+      issues: none
+      packages: write
+      pull-requests: none
+      repository-projects: none
+      security-events: write
+      statuses: none
+      # needed for `cosign attest`
+      id-token: write
     steps:
       - uses: adfinis/[email protected]
         with: