added default perms for ci on utilities (#633)

redhat-cop · Dec 12, 2023 · 6f15924 · 6f15924
1 parent 98a32cd
commit 6f15924
Show file tree

Hide file tree

Showing 8 changed files with 40 additions and 0 deletions.
diff --git a/.github/workflows/ubi8-asciidoctor-pr.yaml b/.github/workflows/ubi8-asciidoctor-pr.yaml
@@ -4,6 +4,10 @@ on:
     paths:
       - utilities/ubi8-asciidoctor/**
       - .github/workflows/ubi8-asciidoctor-pr.yaml
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     env:

diff --git a/.github/workflows/ubi8-asciidoctor-publish.yaml b/.github/workflows/ubi8-asciidoctor-publish.yaml
@@ -6,13 +6,19 @@ on:
     paths:
       - utilities/ubi8-asciidoctor/version.json
       - .github/workflows/ubi8-asciidoctor-publish.yaml
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     env:
       context: utilities/ubi8-asciidoctor
       image_name: ubi8-asciidoctor
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 

diff --git a/.github/workflows/ubi8-bats-pr.yaml b/.github/workflows/ubi8-bats-pr.yaml
@@ -4,6 +4,10 @@ on:
     paths:
       - utilities/ubi8-bats/**
       - .github/workflows/ubi8-bats-pr.yaml
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     env:

diff --git a/.github/workflows/ubi8-bats-publish.yaml b/.github/workflows/ubi8-bats-publish.yaml
@@ -4,13 +4,19 @@ on:
     paths:
       - utilities/ubi8-bats/version.json
       - .github/workflows/ubi8-bats-publish.yaml
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     env:
       context: utilities/ubi8-bats
       image_name: ubi8-bats
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 

diff --git a/.github/workflows/ubi8-git-pr.yaml b/.github/workflows/ubi8-git-pr.yaml
@@ -4,6 +4,10 @@ on:
     paths:
       - utilities/ubi8-git/**
       - .github/workflows/ubi8-git-pr.yaml
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     env:

diff --git a/.github/workflows/ubi8-git-publish.yaml b/.github/workflows/ubi8-git-publish.yaml
@@ -4,13 +4,19 @@ on:
     paths:
       - utilities/ubi8-git/version.json
       - .github/workflows/ubi8-git-publish.yaml
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     env:
       context: utilities/ubi8-git
       image_name: ubi8-git
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 

diff --git a/.github/workflows/ubi8-google-api-python-client-pr.yaml b/.github/workflows/ubi8-google-api-python-client-pr.yaml
@@ -4,6 +4,10 @@ on:
     paths:
       - utilities/ubi8-google-api-python-client/**
       - .github/workflows/ubi8-google-api-python-client-pr.yaml
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     env:

diff --git a/.github/workflows/ubi8-google-api-python-client-publish.yaml b/.github/workflows/ubi8-google-api-python-client-publish.yaml
@@ -4,13 +4,19 @@ on:
     paths:
       - utilities/ubi8-google-api-python-client/version.json
       - .github/workflows/ubi8-google-api-python-client-publish.yaml
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
     env:
       context: utilities/ubi8-google-api-python-client
       image_name: ubi8-google-api-python-client
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4