docs(multiple-actions): move permissions to job level in workflows (#969)

docs(multiple-actions): move permissions to job level in workflow examples

Author: dblinkhorn

actions/aws-auth/README.md

@@ -11,13 +11,11 @@ name: Authenticate to AWS
 on:
   pull_request:
 
-permissions:
-  id-token: write
-
 jobs:
   build:
     runs-on: ubuntu-latest
-
+    permissions:
+      id-token: write
     steps:
       - id: aws-auth
         uses: grafana/shared-workflows/actions/[email protected]

actions/build-push-to-dockerhub/README.md

@@ -12,14 +12,12 @@ name: Push to DockerHub
 on:
   pull_request:
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   build:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - id: checkout
         uses: actions/checkout@v4

actions/dockerhub-login/README.md

@@ -12,14 +12,12 @@ name: Push to DockerHub
 on:
   pull_request:
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   build:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Login to DockerHub
         uses: grafana/shared-workflows/actions/[email protected]

actions/find-pr-for-commit/README.md

@@ -38,12 +38,11 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  pull-requests: read
-
 jobs:
   comment-on-pr-for-commit:
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
       - name: Find PR for current commit
         id: find-pr
@@ -61,12 +60,11 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  pull-requests: read
-
 jobs:
   comment-on-pr-for-commit:
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
       - name: Find PR for specific commit
         id: find-pr
@@ -86,12 +84,11 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  pull-requests: read
-
 jobs:
   comment-on-pr-for-commit:
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
       - name: Find PR for named revision
         id: find-pr

actions/generate-openapi-clients/README.md

@@ -28,12 +28,11 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write # Only needed if `commit-changes` is set to true
-
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Only needed if `commit-changes` is set to true
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v1.0.1
         with:

actions/login-to-gar/README.md

@@ -11,15 +11,13 @@ name: CI
 on:
   pull_request:
 
-# These permissions are needed to assume roles from Github's OIDC.
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   login:
     runs-on: ubuntu-latest
-
+    # These permissions are needed to assume roles from Github's OIDC.
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: grafana/shared-workflows/actions/[email protected]
         id: login-to-gar

actions/login-to-gcs/README.md

@@ -15,13 +15,12 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   login-to-gcs:
     name: login-to-gcs
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: grafana/shared-workflows/actions/[email protected]
         id: login-to-gcs

actions/push-to-gar-docker/README.md

@@ -15,15 +15,13 @@ name: CI
 on:
   pull_request:
 
-# These permissions are needed to assume roles from Github's OIDC.
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
-
+    # These permissions are needed to assume roles from Github's OIDC.
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - id: checkout
         uses: actions/checkout@v4

actions/push-to-gcs/README.md

@@ -18,14 +18,13 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   upload-to-gcs:
     name: upload
     runs-on: ubuntu-x64-small
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:

actions/remove-checkout-credentials/README.md

@@ -6,18 +6,16 @@ For `actions/checkout` it is recommended to pass the `persist-credentials: false
 
 ## Example
 
-```
+```yaml
 name: CI
 on:
   pull_request: {}
 
-permissions:
-  contents: read
-
 jobs:
   build:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with: