1
0
Fork 0
mirror of https://github.com/external-secrets/external-secrets.git synced 2024-12-14 11:57:59 +00:00

fix: restrict the token permission update to the push chart step (#4128)

This commit is contained in:
Gergely Brautigam 2024-11-20 11:19:00 +01:00 committed by GitHub
parent 44e462f510
commit dc7c2ab443
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -71,8 +71,6 @@ jobs:
permissions:
contents: write # for helm/chart-releaser-action to push chart release and create a release
packages: write # to push OCI chart package to GitHub Registry
id-token: write # gives the action the ability to mint the OIDC token necessary to request a Sigstore signing certificate
attestations: write # this permission is necessary to persist the attestation
runs-on: ubuntu-latest
if: |
github.ref == 'refs/heads/main' ||
@ -130,6 +128,9 @@ jobs:
cosign-release: 'v2.4.1'
- name: Push chart to GHCR
permissions:
id-token: write # gives the action the ability to mint the OIDC token necessary to request a Sigstore signing certificate
attestations: write # this permission is necessary to persist the attestation
id: push_chart
run: |
shopt -s nullglob