fix(prune-pull-requests-images-tags): define proper permissions

Signed-off-by: Emilien Escalle <[email protected]> Signed-off-by: Emilien Escalle <[email protected]>
hoverkraft-tech · Jul 16, 2024 · 7282004 · 7282004
1 parent 2483df9
commit 7282004
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/.github/workflows/prune-pull-requests-images-tags.md b/.github/workflows/prune-pull-requests-images-tags.md
@@ -27,7 +27,10 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
   packages: write
+  # FIXME: This is a workaround for having workflow actions. See https://github.com/orgs/community/discussions/38659
+  id-token: write
 
 jobs:
   main:

diff --git a/.github/workflows/prune-pull-requests-images-tags.yml b/.github/workflows/prune-pull-requests-images-tags.yml
@@ -1,12 +1,13 @@
 # Prune pull requests images tags
 # ==========================
 # Workflow to performs a clean of closed pull requests images tags.
-# See <../../actions/docker/prune-pull-requests-image-tags/README.md> for more information.
+# See [prune-pull-requests-image-tags](../../actions/docker/prune-pull-requests-image-tags/README.md) for more information.
 ---
 name: Prune pull requests images tags
 
 on:
   workflow_call:
+    #checkov:skip=CKV_GHA_7: required
     inputs:
       runs-on:
         description: |
@@ -34,7 +35,10 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
   packages: write
+  # FIXME: This is a workaround for having workflow actions. See https://github.com/orgs/community/discussions/38659
+  id-token: write
 
 jobs:
   prepare-variables: