[chore] Fix image publish permissions (#3871)

* Add back the things

* oops

Author: jaronoff97

.github/workflows/publish-autoinstrumentation-apache-httpd.yaml

@@ -3,14 +3,14 @@ name: "Publish Apache HTTPD Auto-Instrumentation"
 on:
   push:
     paths:
-      - 'autoinstrumentation/apache-httpd/**'
-      - '.github/workflows/publish-autoinstrumentation-apache-httpd.yaml'
+      - "autoinstrumentation/apache-httpd/**"
+      - ".github/workflows/publish-autoinstrumentation-apache-httpd.yaml"
     branches:
       - main
   pull_request:
     paths:
-      - 'autoinstrumentation/apache-httpd/**'
-      - '.github/workflows/publish-autoinstrumentation-apache-httpd.yaml'
+      - "autoinstrumentation/apache-httpd/**"
+      - ".github/workflows/publish-autoinstrumentation-apache-httpd.yaml"
   workflow_dispatch:
 
 concurrency:
@@ -19,6 +19,9 @@ concurrency:
 
 permissions:
   contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:

.github/workflows/publish-autoinstrumentation-dotnet.yaml

@@ -3,14 +3,14 @@ name: "Publish DotNet Auto-Instrumentation"
 on:
   push:
     paths:
-      - 'autoinstrumentation/dotnet/**'
-      - '.github/workflows/publish-autoinstrumentation-dotnet.yaml'
+      - "autoinstrumentation/dotnet/**"
+      - ".github/workflows/publish-autoinstrumentation-dotnet.yaml"
     branches:
       - main
   pull_request:
     paths:
-      - 'autoinstrumentation/dotnet/**'
-      - '.github/workflows/publish-autoinstrumentation-dotnet.yaml'
+      - "autoinstrumentation/dotnet/**"
+      - ".github/workflows/publish-autoinstrumentation-dotnet.yaml"
   workflow_dispatch:
 
 concurrency:
@@ -19,6 +19,9 @@ concurrency:
 
 permissions:
   contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:

.github/workflows/publish-autoinstrumentation-java.yaml

@@ -3,23 +3,25 @@ name: "Publish Java Auto-Instrumentation"
 on:
   push:
     paths:
-      - 'autoinstrumentation/java/**'
-      - '.github/workflows/publish-autoinstrumentation-java.yaml'
+      - "autoinstrumentation/java/**"
+      - ".github/workflows/publish-autoinstrumentation-java.yaml"
     branches:
       - main
   pull_request:
     paths:
-      - 'autoinstrumentation/java/**'
-      - '.github/workflows/publish-autoinstrumentation-java.yaml'
+      - "autoinstrumentation/java/**"
+      - ".github/workflows/publish-autoinstrumentation-java.yaml"
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
-
 permissions:
   contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:

.github/workflows/publish-autoinstrumentation-nodejs.yaml

@@ -3,23 +3,25 @@ name: "Publish NodeJS Auto-Instrumentation"
 on:
   push:
     paths:
-      - 'autoinstrumentation/nodejs/**'
-      - '.github/workflows/publish-autoinstrumentation-nodejs.yaml'
+      - "autoinstrumentation/nodejs/**"
+      - ".github/workflows/publish-autoinstrumentation-nodejs.yaml"
     branches:
       - main
   pull_request:
     paths:
-      - 'autoinstrumentation/nodejs/**'
-      - '.github/workflows/publish-autoinstrumentation-nodejs.yaml'
+      - "autoinstrumentation/nodejs/**"
+      - ".github/workflows/publish-autoinstrumentation-nodejs.yaml"
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
-
 permissions:
   contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:

.github/workflows/publish-autoinstrumentation-php.yaml

@@ -3,14 +3,14 @@ name: "Publish PHP Auto-Instrumentation"
 on:
   push:
     paths:
-      - 'autoinstrumentation/php/**'
-      - '.github/workflows/publish-autoinstrumentation-php.yaml'
+      - "autoinstrumentation/php/**"
+      - ".github/workflows/publish-autoinstrumentation-php.yaml"
     branches:
       - main
   pull_request:
     paths:
-      - 'autoinstrumentation/php/**'
-      - '.github/workflows/publish-autoinstrumentation-php.yaml'
+      - "autoinstrumentation/php/**"
+      - ".github/workflows/publish-autoinstrumentation-php.yaml"
   workflow_dispatch:
 
 concurrency:
@@ -19,6 +19,9 @@ concurrency:
 
 permissions:
   contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:

.github/workflows/publish-autoinstrumentation-python.yaml

@@ -3,23 +3,25 @@ name: "Publish Python Auto-Instrumentation"
 on:
   push:
     paths:
-      - 'autoinstrumentation/python/**'
-      - '.github/workflows/publish-autoinstrumentation-python.yaml'
+      - "autoinstrumentation/python/**"
+      - ".github/workflows/publish-autoinstrumentation-python.yaml"
     branches:
       - main
   pull_request:
     paths:
-      - 'autoinstrumentation/python/**'
-      - '.github/workflows/publish-autoinstrumentation-python.yaml'
+      - "autoinstrumentation/python/**"
+      - ".github/workflows/publish-autoinstrumentation-python.yaml"
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
-
 permissions:
   contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:

.github/workflows/publish-images.yaml

@@ -2,8 +2,8 @@ name: "Publish operator"
 
 on:
   push:
-    branches: [ main ]
-    tags: [ 'v*' ]
+    branches: [main]
+    tags: ["v*"]
 
   workflow_dispatch:
 
@@ -12,6 +12,9 @@ env:
 
 permissions:
   contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:
@@ -22,7 +25,7 @@ jobs:
 
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
-          go-version: '~1.24.2'
+          go-version: "~1.24.2"
 
       - name: Unshallow
         run: git fetch --prune --unshallow

.github/workflows/publish-must-gather.yaml

@@ -2,8 +2,8 @@ name: "Publish must-gather image"
 
 on:
   push:
-    branches: [ main ]
-    tags: [ 'v*' ]
+    branches: [main]
+    tags: ["v*"]
 
   workflow_dispatch:
 
@@ -12,6 +12,9 @@ env:
 
 permissions:
   contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:
@@ -22,7 +25,7 @@ jobs:
 
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
-          go-version: '~1.24.2'
+          go-version: "~1.24.2"
 
       - name: Unshallow
         run: git fetch --prune --unshallow

.github/workflows/publish-operator-bundle.yaml

@@ -3,17 +3,19 @@ name: "Publish operator bundle"
 on:
   push:
     paths:
-      - '.github/workflows/publish-operator-bundle.yaml'
-      - 'bundle/**'
+      - ".github/workflows/publish-operator-bundle.yaml"
+      - "bundle/**"
     branches:
       - main
     tags:
-      - 'v*'
+      - "v*"
   workflow_dispatch:
 
 permissions:
   contents: read
   packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:
@@ -35,7 +37,6 @@ jobs:
             type=semver,pattern={{raw}}
             type=ref,event=branch
 
-
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 

.github/workflows/publish-operator-opamp-bridge.yaml

@@ -3,19 +3,22 @@ name: "Publish Operator OpAMP Bridge"
 on:
   push:
     paths:
-      - 'cmd/operator-opamp-bridge/**'
-      - '.github/workflows/publish-operator-opamp-bridge.yaml'
+      - "cmd/operator-opamp-bridge/**"
+      - ".github/workflows/publish-operator-opamp-bridge.yaml"
     branches:
       - main
     tags:
-      - 'v*'
+      - "v*"
   workflow_dispatch:
 
 env:
   PLATFORMS: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
 
 permissions:
   contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   publish:
@@ -26,7 +29,7 @@ jobs:
 
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
-          go-version: '~1.24.2'
+          go-version: "~1.24.2"
 
       # TODO: We're currently not using this. Should we?
       - name: Read version