From a5f3cc786eecf733d155f18bd62d292c1924ea83 Mon Sep 17 00:00:00 2001 From: Jesse Hallam Date: Wed, 13 Aug 2025 17:17:37 -0300 Subject: [PATCH] setup permissions for chainguard-dev/setup-chainctl (#33676) Setting `id-token: write` allows the workflow to request and use a JSON Web Token (JWT) from GitHub's OIDC provider. This JWT can then be exchanged with an external service -- in this case, ChainGuard -- to obtain short-lived credentials for authenticating and performing actions on that service. --- .github/workflows/build-server-image.yml | 5 +++++ .github/workflows/dispatch-server-builder-image.yml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/build-server-image.yml b/.github/workflows/build-server-image.yml index 0b9c463419b..5f747bed210 100644 --- a/.github/workflows/build-server-image.yml +++ b/.github/workflows/build-server-image.yml @@ -12,6 +12,11 @@ on: env: CHAINCTL_IDENTITY: ee399b4c72dd4e58e3d617f78fc47b74733c9557/922f2d48307d6f5f +# Permissions required for chainguard-dev/setup-chainctl +permissions: + id-token: write + contents: read + jobs: build-image: runs-on: ubuntu-22.04 diff --git a/.github/workflows/dispatch-server-builder-image.yml b/.github/workflows/dispatch-server-builder-image.yml index 6c82ff7a7f5..d390fba4fd8 100644 --- a/.github/workflows/dispatch-server-builder-image.yml +++ b/.github/workflows/dispatch-server-builder-image.yml @@ -14,6 +14,11 @@ on: env: CHAINCTL_IDENTITY: ee399b4c72dd4e58e3d617f78fc47b74733c9557/922f2d48307d6f5f +# Permissions required for chainguard-dev/setup-chainctl +permissions: + id-token: write + contents: read + jobs: build-and-push: runs-on: ubuntu-latest