Flyttet permission til kallende workflow

navikt · Sep 4, 2023 · c8d05eb · c8d05eb
1 parent 6618b0b
commit c8d05eb
Show file tree

Hide file tree

Showing 87 changed files with 255 additions and 6 deletions.
diff --git a/.github/workflows/app.adresse-service.yml b/.github/workflows/app.adresse-service.yml
@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/adresse-service"
       deploy-tag: "#deploy-adresse-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.amelding-service.yml b/.github/workflows/app.amelding-service.yml
@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/amelding-service"
       deploy-tag: "#deploy-amelding-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.app-tilgang-analyse-service.yml b/.github/workflows/app.app-tilgang-analyse-service.yml
@@ -15,6 +15,9 @@ jobs:
     with:
       working-directory: "apps/app-tilgang-analyse-service"
       deploy-tag: "#deploy-app-tilgang-analyse-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.arbeidsforhold-export-api.yml b/.github/workflows/app.arbeidsforhold-export-api.yml
@@ -17,6 +17,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/arbeidsforhold-export-api"
       deploy-tag: "#deploy-arbeidsforhold-export-api"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.arbeidsforhold-service.yml b/.github/workflows/app.arbeidsforhold-service.yml
@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/arbeidsforhold-service"
       deploy-tag: "#deploy-arbeidsforhold-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.batch-bestilling-service.yml b/.github/workflows/app.batch-bestilling-service.yml
@@ -19,6 +19,9 @@ jobs:
     with:
       working-directory: "apps/batch-bestilling-service"
       deploy-tag: "#deploy-batch-bestilling-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.brreg-stub.yml b/.github/workflows/app.brreg-stub.yml
@@ -15,6 +15,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/brreg-stub"
       deploy-tag: "#deploy-brreg-stub"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.bruker-service.yml b/.github/workflows/app.bruker-service.yml
@@ -18,6 +18,9 @@ jobs:
       working-directory: "apps/bruker-service"
       deploy-tag: "#deploy-bruker-service"
       deploy-tag-test: "#deploy-test-bruker-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.dolly-backend.yml b/.github/workflows/app.dolly-backend.yml
@@ -20,6 +20,9 @@ jobs:
       working-directory: "apps/dolly-backend"
       deploy-tag: "#deploy-dolly-backend"
       deploy-tag-test: "#deploy-test-dolly-backend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.dolly-frontend.yml b/.github/workflows/app.dolly-frontend.yml
@@ -31,6 +31,9 @@ jobs:
       deploy-tag-test: "#deploy-test-frontend"
       deploy-tag-idporten: "#deploy-idporten-frontend"
       deploy-tag-unstable: "#deploy-unstable-frontend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.dollystatus.yml b/.github/workflows/app.dollystatus.yml
@@ -12,6 +12,9 @@ jobs:
     with:
       working-directory: "apps/dollystatus"
       deploy-tag: "#deploy-dollystatus"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.endringsmelding-frontend.yml b/.github/workflows/app.endringsmelding-frontend.yml
@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/endringsmelding-frontend"
       deploy-tag: "#deploy-endringsmelding-frontend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.endringsmelding-service.yml b/.github/workflows/app.endringsmelding-service.yml
@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/endringsmelding-service"
       deploy-tag: "#deploy-endringsmelding-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.ereg-batch-status-service.yml b/.github/workflows/app.ereg-batch-status-service.yml
@@ -17,6 +17,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/ereg-batch-status-service"
       deploy-tag: "#deploy-ereg-batch-status-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.faste-data-frontend.yml b/.github/workflows/app.faste-data-frontend.yml
@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/faste-data-frontend"
       deploy-tag: "#deploy-faste-data-frontend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.generer-arbeidsforhold-populasjon-service.yml b/.github/workflows/app.generer-arbeidsforhold-populasjon-service.yml
@@ -17,6 +17,9 @@ jobs:
     with:
       working-directory: "apps/generer-arbeidsforhold-populasjon-service"
       deploy-tag: "#deploy-generer-arbeidsforhold-populasjon-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.generer-navn-service.yml b/.github/workflows/app.generer-navn-service.yml
@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/generer-navn-service"
       deploy-tag: "#deploy-generer-navn-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.generer-organisasjon-populasjon-service.yml b/.github/workflows/app.generer-organisasjon-populasjon-service.yml
@@ -22,6 +22,9 @@ jobs:
     with:
       working-directory: "apps/generer-organisasjon-populasjon-service"
       deploy-tag: "#deploy-generer-organisasjon-populasjon-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.generer-synt-amelding-service.yml b/.github/workflows/app.generer-synt-amelding-service.yml
@@ -17,6 +17,9 @@ jobs:
     with:
       working-directory: "apps/generer-synt-amelding-service"
       deploy-tag: "#deploy-generer-synt-amelding-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.geografiske-kodeverk-service.yml b/.github/workflows/app.geografiske-kodeverk-service.yml
@@ -15,6 +15,9 @@ jobs:
     with:
       working-directory: "apps/geografiske-kodeverk-service"
       deploy-tag: "#deploy-geografiske-kodeverk-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.helsepersonell-service.yml b/.github/workflows/app.helsepersonell-service.yml
@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/helsepersonell-service"
       deploy-tag: "#deploy-helsepersonell-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.hodejegeren.yml b/.github/workflows/app.hodejegeren.yml
@@ -17,6 +17,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/hodejegeren"
       deploy-tag: "#deploy-hodejegeren"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.inntektsmelding-generator-service.yml b/.github/workflows/app.inntektsmelding-generator-service.yml
@@ -15,6 +15,9 @@ jobs:
     with:
       working-directory: "apps/inntektsmelding-generator-service/"
       deploy-tag: "#deploy-inntektsmelding-generator-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.inntektsmelding-service.yml b/.github/workflows/app.inntektsmelding-service.yml
@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/inntektsmelding-service"
       deploy-tag: "#deploy-inntektsmelding-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.jenkins-batch-status-service.yml b/.github/workflows/app.jenkins-batch-status-service.yml
@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/jenkins-batch-status-service"
       deploy-tag: "#deploy-jenkins-batch-status-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.joark-dokument-service.yml b/.github/workflows/app.joark-dokument-service.yml
@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/joark-dokument-service"
       deploy-tag: "#deploy-joark-dokument-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.miljoer-service.yml b/.github/workflows/app.miljoer-service.yml
@@ -17,6 +17,9 @@ jobs:
     with:
       working-directory: "apps/miljoer-service"
       deploy-tag: "#deploy-miljoer-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.mn-synt-arbeidsforhold-service.yml b/.github/workflows/app.mn-synt-arbeidsforhold-service.yml
@@ -19,6 +19,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/mn-synt-arbeidsforhold-service"
       deploy-tag: "#deploy-mn-synt-arbeidsforhold-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.oppsummeringsdokument-service.yml b/.github/workflows/app.oppsummeringsdokument-service.yml
@@ -17,6 +17,9 @@ jobs:
     with:
       working-directory: "apps/oppsummeringsdokument-service"
       deploy-tag: "#deploy-oppsummeringsdokument-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.organisasjon-bestilling-service.yml b/.github/workflows/app.organisasjon-bestilling-service.yml
@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-bestilling-service"
       deploy-tag: "#deploy-organisasjon-bestilling-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.organisasjon-faste-data-service.yml b/.github/workflows/app.organisasjon-faste-data-service.yml
@@ -22,6 +22,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-faste-data-service"
       deploy-tag: "#deploy-organisasjon-faste-data-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.organisasjon-forvalter.yml b/.github/workflows/app.organisasjon-forvalter.yml
@@ -22,6 +22,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-forvalter"
       deploy-tag: "#deploy-organisasjon-forvalter"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.organisasjon-mottak-service.yml b/.github/workflows/app.organisasjon-mottak-service.yml
@@ -21,6 +21,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-mottak-service"
       deploy-tag: "#deploy-organisasjon-mottak-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.organisasjon-service.yml b/.github/workflows/app.organisasjon-service.yml
@@ -19,6 +19,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-service"
       deploy-tag: "#deploy-organisasjon-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.organisasjon-tilgang-frontend-prod.yml b/.github/workflows/app.organisasjon-tilgang-frontend-prod.yml
@@ -18,6 +18,9 @@ jobs:
       nais-manifest: "config.prod.yml"
       working-directory: "apps/organisasjon-tilgang-frontend"
       deploy-tag: "#deploy-organisasjon-tilgang-frontend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.organisasjon-tilgang-frontend.yml b/.github/workflows/app.organisasjon-tilgang-frontend.yml
@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-tilgang-frontend"
       deploy-tag: "#deploy-test-organisasjon-tilgang-frontend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.organisasjon-tilgang-service-prod.yml b/.github/workflows/app.organisasjon-tilgang-service-prod.yml
@@ -16,6 +16,9 @@ jobs:
       nais-manifest: "config.prod.yml"
       working-directory: "apps/organisasjon-tilgang-service"
       deploy-tag: "#deploy-organisasjon-tilgang-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.organisasjon-tilgang-service.yml b/.github/workflows/app.organisasjon-tilgang-service.yml
@@ -14,6 +14,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-tilgang-service"
       deploy-tag: "#deploy-test-organisasjon-tilgang-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.orgnummer-service.yml b/.github/workflows/app.orgnummer-service.yml
@@ -19,6 +19,9 @@ jobs:
     with:
       working-directory: "apps/orgnummer-service"
       deploy-tag: "#deploy-orgnummer-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

diff --git a/.github/workflows/app.oversikt-frontend.yml b/.github/workflows/app.oversikt-frontend.yml
@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/oversikt-frontend"
       deploy-tag: "#deploy-oversikt-frontend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}