quine-global-labs/aurora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(ci): tighten image build workflows permissions (#2526)

Browse source 
should help a little bit with the openssf score
This commit is contained in:
renner 2026-07-08 19:21:04 +02:00 committed by GitHub
parent 587540823d
commit 8b90b5809c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 21 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
.github/workflows/build-image-latest-main.yml vendored
View file

@ -20,17 +20,18 @@ on:
workflow_call:
workflow_dispatch:
permissions:
contents: read
packages: write
id-token: write
attestations: write
artifact-metadata: write
permissions: {}
jobs:
build-image-latest:
name: Build Latest Images
uses: ./.github/workflows/reusable-build.yml
permissions:
contents: read
packages: write
id-token: write
attestations: write
artifact-metadata: write
secrets: inherit
strategy:
fail-fast: false

13
.github/workflows/build-image-stable.yml vendored
View file

@ -14,17 +14,18 @@ on:
workflow_call:
workflow_dispatch:
permissions:
contents: read
packages: write
id-token: write
attestations: write
artifact-metadata: write
permissions: {}
jobs:
build-image-stable:
name: Build Stable Images
uses: ./.github/workflows/reusable-build.yml
permissions:
contents: read
packages: write
id-token: write
attestations: write
artifact-metadata: write
secrets: inherit
strategy:
fail-fast: false

13
.github/workflows/build-image-testing.yml vendored
View file

@ -11,17 +11,18 @@ on:
workflow_call:
workflow_dispatch:
permissions:
contents: read
packages: write
id-token: write
attestations: write
artifact-metadata: write
permissions: {}
jobs:
build-image-testing:
name: Build Testing Images
uses: ./.github/workflows/reusable-build.yml
permissions:
contents: read
packages: write
id-token: write
attestations: write
artifact-metadata: write
secrets: inherit
strategy:
fail-fast: false