Update README.md (slsa-framework#579)

Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
ramonpetgrave64 · Jul 19, 2022 · f50e382 · f50e382
1 parent 9a745cb
commit f50e382
Showing 1 changed file with 9 additions and 9 deletions.
diff --git a/internal/builders/generic/README.md b/internal/builders/generic/README.md
@@ -338,9 +338,9 @@ jobs:
   provenance:
     needs: [goreleaser]
     permissions:
-      actions: read
-      id-token: write
-      contents: read
+      actions: read   # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.1.1
     with:
       base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
@@ -417,9 +417,9 @@ jobs:
   provenance:
     needs: [build]
     permissions:
-      actions: read
-      id-token: write
-      contents: read
+      actions: read   # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.1.1
     with:
       base64-subjects: "${{ needs.build.outputs.hashes }}"
@@ -500,9 +500,9 @@ jobs:
   provenance:
     needs: [build]
     permissions:
-      actions: read
-      id-token: write
-      contents: read
+      actions: read   # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.1.1
     with:
       base64-subjects: "${{ needs.build.outputs.hashes }}"