(fix) fix aath publishing (hyperledger#1283)

* try permissions in CI Signed-off-by: George Mulhearn <gmulhearn@anonyome.com> * typo Signed-off-by: George Mulhearn <gmulhearn@anonyome.com> * change for the sake of it Signed-off-by: George Mulhearn <gmulhearn@anonyome.com> * try global permissions Signed-off-by: George Mulhearn <gmulhearn@anonyome.com> * revert and scope the permissions Signed-off-by: George Mulhearn <gmulhearn@anonyome.com> --------- Signed-off-by: George Mulhearn <gmulhearn@anonyome.com> Co-authored-by: George Mulhearn <gmulhearn@anonyome.com>
instnt-inc · Sep 10, 2024 · d1357d9 · d1357d9
1 parent 3863487
commit d1357d9
Showing 1 changed file with 14 additions and 2 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -146,9 +146,12 @@ jobs:
 
   # todo: move to indy-vdr repo
   build-docker-vdrproxy:
+    runs-on: ubuntu-20.04
+    permissions:
+      contents: read
+      packages: write
     needs: [ workflow-setup ]
     if: ${{ needs.workflow-setup.outputs.SKIP_CI != 'true' }}
-    runs-on: ubuntu-20.04
     env:
       DOCKER_IMG_CACHED: ${{ needs.workflow-setup.outputs.DOCKER_IMG_CACHED_VDRPROXY }}
       BRANCH_NAME: ${{ needs.workflow-setup.outputs.BRANCH_NAME }}
@@ -176,9 +179,12 @@ jobs:
 
   # builds and publishes main branch AATH backchannels
   build-docker-aath-backchannel:
+    runs-on: ubuntu-20.04
+    permissions:
+      contents: read
+      packages: write
     needs: [ workflow-setup ]
     if: ${{ needs.workflow-setup.outputs.IS_MAIN_BRANCH == 'true' }}
-    runs-on: ubuntu-20.04
     env:
       DOCKER_IMG_CACHED: ${{ needs.workflow-setup.outputs.DOCKER_IMG_CACHED_AATH }}
       BRANCH_NAME: ${{ needs.workflow-setup.outputs.BRANCH_NAME }}
@@ -209,6 +215,9 @@ jobs:
 
   publish-docker-vdrproxy:
     runs-on: ubuntu-20.04
+    permissions:
+      contents: read
+      packages: write
     needs: [ workflow-setup, build-docker-vdrproxy ]
     if: ${{ needs.workflow-setup.outputs.SKIP_CI != 'true' }}
     env:
@@ -237,6 +246,9 @@ jobs:
   # additional publish of the AATH backchannel image with tagged versions for tags
   publish-docker-aath-backchannel:
     runs-on: ubuntu-20.04
+    permissions:
+      contents: read
+      packages: write
     needs: [ workflow-setup, build-docker-aath-backchannel ]
     if: ${{ needs.workflow-setup.outputs.RELEASE == 'true' || needs.workflow-setup.outputs.PRERELEASE == 'true' }}
     env: