fix: permissions for slsa provenance

Kong · Jun 4, 2024 · 4508e71 · 4508e71
1 parent 722d268
commit 4508e71
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
@@ -290,6 +290,7 @@ jobs:
       id-token: write # needed for signing the images
       actions: read # For getting workflow run info to build provenance
       packages: write # Required for publishing provenance. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues
+      contents: read
     strategy:
       fail-fast: true
       matrix:
@@ -314,6 +315,7 @@ jobs:
       actions: read # For getting workflow run info to build provenance
       packages: write # Required for publishing provenance. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues
     # need to use non hash version because of: https://github.com/slsa-framework/slsa-github-generator/issues/3498
+      contents: read
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
     with:
       image: ${{ needs.publish.outputs.INSO_DOCKER_IMAGE }}