fix checkov gha

Signed-off-by: André Bauer <andre.bauer@staffbase.com>
kokuwaio · Apr 29, 2024 · 543105f · 543105f
1 parent 6d302ae
commit 543105f
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 0 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -1,5 +1,7 @@
 name: ci
 
+permissions: read-all
+
 on: 
   pull_request:
     paths:

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -1,5 +1,7 @@
 name: Release Charts
 
+permissions: read-all
+
 on:
   push:
     branches:
@@ -10,6 +12,10 @@ env:
 
 jobs:
   release:
+    permissions:
+      contents: write # to push chart release and create a release (helm/chart-releaser-action)
+      packages: write # needed for ghcr access
+      id-token: write # needed for keyless signing
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout

diff --git a/.github/workflows/sync-readme.yaml b/.github/workflows/sync-readme.yaml
@@ -1,5 +1,7 @@
 name: sync-readme
 
+permissions: read-all
+
 on:
   push:
     branches:
@@ -9,6 +11,8 @@ on:
 
 jobs:
   build:
+    permissions:
+      contents: write # for git push
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4