[gh-1322] Potential permissions fix

ashmind · Jan 6, 2024 · 557fe03 · 557fe03
1 parent 26eab68
commit 557fe03
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 6 deletions.
diff --git a/.github/workflows/server-edge.yml b/.github/workflows/server-edge.yml
@@ -14,6 +14,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  id-token: write
+
 jobs:
   build-core:
     name: 'Build (.NET 8)'
@@ -82,6 +85,8 @@ jobs:
            environment: edge-server-x64
     name: 'Deploy to Edge (${{ matrix.name }})'
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     needs: build-core
     if: github.ref == 'refs/heads/main'
     environment: ${{ matrix.environment }}
@@ -142,6 +147,8 @@ jobs:
            environment: edge-server-netfx-x64
     name: 'Deploy to Edge (${{ matrix.name }})'
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     needs: build-netfx
     if: github.ref == 'refs/heads/main'
     environment: ${{ matrix.environment }}
@@ -167,6 +174,8 @@ jobs:
   create-release:
     name: 'Create Release'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     needs:
       - deploy-core
       - deploy-netfx

diff --git a/.github/workflows/server-main.yml b/.github/workflows/server-main.yml
@@ -33,6 +33,8 @@ jobs:
 
     name: 'Deploy to Main (${{ matrix.name }})'
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     environment: ${{ matrix.environment }}
     steps:
       - uses: actions/github-script@v6

diff --git a/.github/workflows/webapp-edge.yml b/.github/workflows/webapp-edge.yml
@@ -10,15 +10,14 @@ on:
   pull_request:
   workflow_dispatch:
 
-permissions:
-  id-token: write
-
 jobs:
   build:
     name: Build
     # https://github.uint.cloudmunity/t/duplicate-checks-on-push-and-pull-request-simultaneous-event/18012/5
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     defaults:
       run:
         working-directory: source/WebApp
@@ -110,6 +109,8 @@ jobs:
     if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/feature/execution-flow-output-squashed'
     environment: edge-webapp
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@v3
         with:

diff --git a/.github/workflows/webapp-main.yml b/.github/workflows/webapp-main.yml
@@ -2,14 +2,13 @@ name: WebApp (JS) - Main
 
 on: workflow_dispatch
 
-permissions:
-  id-token: write
-
 jobs:
   deploy-to-main:
     name: Deploy (Main)
     environment: main-webapp
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: azure/login@v1
         with: