From 47628eef75567d554c02176ac3ccdc800f564a90 Mon Sep 17 00:00:00 2001 From: Ringo De Smet Date: Tue, 17 Dec 2024 10:17:41 +0100 Subject: [PATCH] Set permissions on the calling side. (#1233) The `permissions` block in a reusable workflow doesn't grant these permissions. These are more used as an early indication of the permissions required by the reusable workflow. The correct permissions still need to be set on the calling side. See `Reusable workflows` in [this blog article](https://www.kenmuse.com/blog/github-actions-workflow-permissions/). Follow up to #1214. Without setting the `permissions` on the calling side, the reusable workflow will not have the correct permissions. The Pulumiverse runs failed without the required `permissions` block: https://github.com/pulumiverse/pulumi-acme/actions/runs/12365788538 After adding the `permissions` block on the calling side: https://github.com/pulumiverse/pulumi-acme/actions/runs/12369028130 https://github.com/pulumiverse/pulumi-acme/pull/98 For Pulumiverse, this fails because the organization wide workflow settings are configured to `Read repository contents and packages permissions`. --- .../pkg/templates/bridged-provider/.github/workflows/main.yml | 3 +++ .../bridged-provider/.github/workflows/nightly-test.yml | 3 +++ .../bridged-provider/.github/workflows/prerelease.yml | 3 +++ .../templates/bridged-provider/.github/workflows/release.yml | 3 +++ .../.github/workflows/run-acceptance-tests.yml | 3 +++ provider-ci/test-providers/acme/.github/workflows/main.yml | 3 +++ .../test-providers/acme/.github/workflows/prerelease.yml | 3 +++ provider-ci/test-providers/acme/.github/workflows/release.yml | 3 +++ .../acme/.github/workflows/run-acceptance-tests.yml | 3 +++ provider-ci/test-providers/aws/.github/workflows/master.yml | 3 +++ .../test-providers/aws/.github/workflows/nightly-test.yml | 3 +++ .../test-providers/aws/.github/workflows/prerelease.yml | 3 +++ provider-ci/test-providers/aws/.github/workflows/release.yml | 3 +++ .../aws/.github/workflows/run-acceptance-tests.yml | 3 +++ .../test-providers/cloudflare/.github/workflows/master.yml | 3 +++ .../test-providers/cloudflare/.github/workflows/prerelease.yml | 3 +++ .../test-providers/cloudflare/.github/workflows/release.yml | 3 +++ .../cloudflare/.github/workflows/run-acceptance-tests.yml | 3 +++ provider-ci/test-providers/docker/.github/workflows/master.yml | 3 +++ .../test-providers/docker/.github/workflows/prerelease.yml | 3 +++ .../test-providers/docker/.github/workflows/release.yml | 3 +++ .../docker/.github/workflows/run-acceptance-tests.yml | 3 +++ 22 files changed, 66 insertions(+) diff --git a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/main.yml b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/main.yml index 7d4172ebd..d9be55a65 100644 --- a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/main.yml +++ b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/main.yml @@ -122,6 +122,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/nightly-test.yml b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/nightly-test.yml index 80491a72c..4185e0325 100644 --- a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/nightly-test.yml +++ b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/nightly-test.yml @@ -33,6 +33,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/prerelease.yml b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/prerelease.yml index 860fc3a66..1c58ff9c9 100644 --- a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/prerelease.yml +++ b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/prerelease.yml @@ -60,6 +60,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/release.yml b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/release.yml index 93acf0197..da7e49d70 100644 --- a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/release.yml +++ b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/release.yml @@ -69,6 +69,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/run-acceptance-tests.yml b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/run-acceptance-tests.yml index b7298fa3c..2319a6cdf 100644 --- a/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/internal/pkg/templates/bridged-provider/.github/workflows/run-acceptance-tests.yml @@ -111,6 +111,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/acme/.github/workflows/main.yml b/provider-ci/test-providers/acme/.github/workflows/main.yml index 4a76498dc..6249694da 100644 --- a/provider-ci/test-providers/acme/.github/workflows/main.yml +++ b/provider-ci/test-providers/acme/.github/workflows/main.yml @@ -131,6 +131,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/acme/.github/workflows/prerelease.yml b/provider-ci/test-providers/acme/.github/workflows/prerelease.yml index 2dffdec67..8736a9f2f 100644 --- a/provider-ci/test-providers/acme/.github/workflows/prerelease.yml +++ b/provider-ci/test-providers/acme/.github/workflows/prerelease.yml @@ -72,6 +72,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/acme/.github/workflows/release.yml b/provider-ci/test-providers/acme/.github/workflows/release.yml index ac7ff2213..3720ee2f4 100644 --- a/provider-ci/test-providers/acme/.github/workflows/release.yml +++ b/provider-ci/test-providers/acme/.github/workflows/release.yml @@ -78,6 +78,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml index dc2df3c2b..8d4402f7a 100644 --- a/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml @@ -121,6 +121,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/aws/.github/workflows/master.yml b/provider-ci/test-providers/aws/.github/workflows/master.yml index 46d9d95c8..afa1a65d0 100644 --- a/provider-ci/test-providers/aws/.github/workflows/master.yml +++ b/provider-ci/test-providers/aws/.github/workflows/master.yml @@ -131,6 +131,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/aws/.github/workflows/nightly-test.yml b/provider-ci/test-providers/aws/.github/workflows/nightly-test.yml index c4228a9f7..d9124a001 100644 --- a/provider-ci/test-providers/aws/.github/workflows/nightly-test.yml +++ b/provider-ci/test-providers/aws/.github/workflows/nightly-test.yml @@ -50,6 +50,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/aws/.github/workflows/prerelease.yml b/provider-ci/test-providers/aws/.github/workflows/prerelease.yml index 1912cb457..bec419dca 100644 --- a/provider-ci/test-providers/aws/.github/workflows/prerelease.yml +++ b/provider-ci/test-providers/aws/.github/workflows/prerelease.yml @@ -71,6 +71,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/aws/.github/workflows/release.yml b/provider-ci/test-providers/aws/.github/workflows/release.yml index e80c5c1b1..b66d7cb83 100644 --- a/provider-ci/test-providers/aws/.github/workflows/release.yml +++ b/provider-ci/test-providers/aws/.github/workflows/release.yml @@ -77,6 +77,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml index 875adc224..08df2d05c 100644 --- a/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml @@ -117,6 +117,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/master.yml b/provider-ci/test-providers/cloudflare/.github/workflows/master.yml index c1830eb28..e37f37beb 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/master.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/master.yml @@ -133,6 +133,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/prerelease.yml b/provider-ci/test-providers/cloudflare/.github/workflows/prerelease.yml index b1fe5c654..45ddc69d8 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/prerelease.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/prerelease.yml @@ -74,6 +74,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/release.yml b/provider-ci/test-providers/cloudflare/.github/workflows/release.yml index 30a15133a..6c72112da 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/release.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/release.yml @@ -80,6 +80,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml index aa933fbb7..329f8110e 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml @@ -123,6 +123,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/docker/.github/workflows/master.yml b/provider-ci/test-providers/docker/.github/workflows/master.yml index cc1b3ab7f..1a0d08ea6 100644 --- a/provider-ci/test-providers/docker/.github/workflows/master.yml +++ b/provider-ci/test-providers/docker/.github/workflows/master.yml @@ -146,6 +146,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/docker/.github/workflows/prerelease.yml b/provider-ci/test-providers/docker/.github/workflows/prerelease.yml index a6ec77820..f21ab94ec 100644 --- a/provider-ci/test-providers/docker/.github/workflows/prerelease.yml +++ b/provider-ci/test-providers/docker/.github/workflows/prerelease.yml @@ -87,6 +87,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/docker/.github/workflows/release.yml b/provider-ci/test-providers/docker/.github/workflows/release.yml index afe0bbcc1..4f6708d73 100644 --- a/provider-ci/test-providers/docker/.github/workflows/release.yml +++ b/provider-ci/test-providers/docker/.github/workflows/release.yml @@ -93,6 +93,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }} diff --git a/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml index 6e1c83b64..137a652c7 100644 --- a/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml @@ -136,6 +136,9 @@ jobs: - prerequisites - build_provider - build_sdk + permissions: + contents: read + id-token: write secrets: inherit with: version: ${{ needs.prerequisites.outputs.version }}