Skip to content

Add minimum token permissions for all github workflow files #4155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
swiatekm merged 2 commits into from
Jul 7, 2025
Merged

Add minimum token permissions for all github workflow files #4155

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8d8cdcf
Add minimum token permissions for all github workflow files
otelbot[bot] Jul 1, 2025
81ff63d
Merge branch 'main' into token-permissions
swiatekm Jul 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/continuous-integration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ on:
pull_request:
branches: [ main ]

permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true
Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/e2e-junit-report.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,14 @@ on:
required: true

permissions:
checks: write
pull-requests: write
actions: read
contents: read

jobs:
report:
permissions:
checks: write
pull-requests: write
actions: read
runs-on: ubuntu-latest
steps:
- name: Download Test Report
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-autoinstrumentation-apache-httpd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,13 @@ concurrency:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-autoinstrumentation-dotnet.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,13 @@ concurrency:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-autoinstrumentation-java.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,13 @@ concurrency:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-autoinstrumentation-nodejs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,13 @@ concurrency:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-autoinstrumentation-php.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,13 @@ concurrency:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-autoinstrumentation-python.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,13 @@ concurrency:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,13 @@ env:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
name: Publish container images
runs-on: ubuntu-latest
steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-must-gather.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,13 @@ env:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
name: Publish must-gather container image
runs-on: ubuntu-latest
steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-operator-bundle.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,13 @@ on:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
7 changes: 7 additions & 0 deletions .github/workflows/publish-operator-hub.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,13 @@ on:
release:
types: [published]

permissions:
contents: read

jobs:
operator-hub-prod-release:
permissions: # required by the reusable workflow
contents: write
uses: ./.github/workflows/reusable-operator-hub-release.yaml
with:
org: redhat-openshift-ecosystem
Expand All @@ -14,6 +19,8 @@ jobs:
OPENTELEMETRYBOT_GITHUB_TOKEN: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN }}

operator-hub-community-release:
permissions: # required by the reusable workflow
contents: write
uses: ./.github/workflows/reusable-operator-hub-release.yaml
with:
org: k8s-operatorhub
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-operator-opamp-bridge.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,13 @@ env:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/publish-target-allocator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,13 @@ env:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
35 changes: 35 additions & 0 deletions .github/workflows/publish-test-e2e-images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,47 +13,82 @@ on:
- '.github/workflows/publish-test-e2e-images.yaml'
workflow_dispatch:

permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true

jobs:
bridge-server:
permissions: # required by the reusable workflow
packages: write
attestations: write
id-token: write
uses: ./.github/workflows/reusable-publish-test-e2e-images.yaml
with:
path: bridge-server
platforms: linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
golang:
permissions: # required by the reusable workflow
packages: write
attestations: write
id-token: write
uses: ./.github/workflows/reusable-publish-test-e2e-images.yaml
with:
path: golang
platforms: linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
python:
permissions: # required by the reusable workflow
packages: write
attestations: write
id-token: write
uses: ./.github/workflows/reusable-publish-test-e2e-images.yaml
with:
path: python
platforms: linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
java:
permissions: # required by the reusable workflow
packages: write
attestations: write
id-token: write
uses: ./.github/workflows/reusable-publish-test-e2e-images.yaml
with:
path: java
platforms: linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
apache-httpd:
permissions: # required by the reusable workflow
packages: write
attestations: write
id-token: write
uses: ./.github/workflows/reusable-publish-test-e2e-images.yaml
with:
path: apache-httpd
platforms: linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
dotnet:
permissions: # required by the reusable workflow
packages: write
attestations: write
id-token: write
uses: ./.github/workflows/reusable-publish-test-e2e-images.yaml
with:
path: dotnet
platforms: linux/arm64,linux/amd64
nodejs:
permissions: # required by the reusable workflow
packages: write
attestations: write
id-token: write
uses: ./.github/workflows/reusable-publish-test-e2e-images.yaml
with:
path: nodejs
platforms: linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
metrics-basic-auth:
permissions: # required by the reusable workflow
packages: write
attestations: write
id-token: write
uses: ./.github/workflows/reusable-publish-test-e2e-images.yaml
with:
path: metrics-basic-auth
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ on:
paths:
- 'versions.txt'

permissions:
contents: read

jobs:
get-versions:
runs-on: ubuntu-latest
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/reusable-publish-test-e2e-images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,13 @@ on:

permissions:
contents: read
packages: write
attestations: write
id-token: write

jobs:
publish-e2e-image:
permissions:
packages: write
attestations: write
id-token: write
runs-on: ubuntu-latest

steps:
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/shellcheck.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,8 @@ on:
branches:
- main
pull_request:
permissions: {}
permissions:
contents: read

jobs:
shellcheck:
Expand Down
Loading