ci: fix permissions for release pipeline to publish binaries (cherry-…

…pick #7512) (#7621) ci: fix permissions for release pipeline to publish binaries (#7512) ci: fix permissions Signed-off-by: Jens Langhammer <[email protected]> Co-authored-by: Jens L <[email protected]>
innet8 · Nov 18, 2023 · f8bfa7e · f8bfa7e
1 parent ea6cf6e
commit f8bfa7e
Show file tree

Hide file tree

Showing 5 changed files with 10 additions and 1 deletion.
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
@@ -187,6 +187,7 @@ jobs:
     needs: ci-core-mark
     runs-on: ubuntu-latest
     permissions:
+      # Needed to upload contianer images to ghcr.io
       packages: write
     timeout-minutes: 120
     steps:
@@ -239,6 +240,7 @@ jobs:
     needs: ci-core-mark
     runs-on: ubuntu-latest
     permissions:
+      # Needed to upload contianer images to ghcr.io
       packages: write
     timeout-minutes: 120
     steps:

diff --git a/.github/workflows/ci-outpost.yml b/.github/workflows/ci-outpost.yml
@@ -67,6 +67,7 @@ jobs:
           - radius
     runs-on: ubuntu-latest
     permissions:
+      # Needed to upload contianer images to ghcr.io
       packages: write
     steps:
       - uses: actions/checkout@v4

diff --git a/.github/workflows/release-next-branch.yml b/.github/workflows/release-next-branch.yml
@@ -6,6 +6,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  # Needed to be able to push to the next branch
   contents: write
 
 jobs:

diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
@@ -8,6 +8,7 @@ jobs:
   build-server:
     runs-on: ubuntu-latest
     permissions:
+      # Needed to upload contianer images to ghcr.io
       packages: write
     steps:
       - uses: actions/checkout@v4
@@ -55,6 +56,7 @@ jobs:
   build-outpost:
     runs-on: ubuntu-latest
     permissions:
+      # Needed to upload contianer images to ghcr.io
       packages: write
     strategy:
       fail-fast: false
@@ -110,6 +112,9 @@ jobs:
   build-outpost-binary:
     timeout-minutes: 120
     runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload binaries to the release
+      contents: write
     strategy:
       fail-fast: false
       matrix:

diff --git a/.github/workflows/repo-stale.yml b/.github/workflows/repo-stale.yml
@@ -6,8 +6,8 @@ on:
   workflow_dispatch:
 
 permissions:
+  # Needed to update issues and PRs
   issues: write
-  pull-requests: write
 
 jobs:
   stale: