From df602af7cf5e94cd93aae0c3eb0775979f1a7886 Mon Sep 17 00:00:00 2001
From: Matthias Bertschy <matthias.bertschy@gmail.com>
Date: Wed, 18 Oct 2023 12:41:04 +0200
Subject: [PATCH] add more missing permissions for actions

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
---
 .github/workflows/00-pr-scanner.yaml          | 14 +++++++
 .github/workflows/02-release.yaml             | 40 ++++++++++++++++++-
 .../b-binary-build-and-e2e-tests.yaml         |  5 +++
 3 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/00-pr-scanner.yaml b/.github/workflows/00-pr-scanner.yaml
index b9e21cc4..cfe4a8b4 100644
--- a/.github/workflows/00-pr-scanner.yaml
+++ b/.github/workflows/00-pr-scanner.yaml
@@ -41,6 +41,20 @@ jobs:
     secrets: inherit
 
   binary-build:
+    permissions:
+      actions: read
+      checks: read
+      contents: read
+      deployments: read
+      discussions: read
+      id-token: write
+      issues: read
+      packages: write
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      security-events: read
+      statuses: read
     uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml
     with:
       COMPONENT_NAME: kubescape
diff --git a/.github/workflows/02-release.yaml b/.github/workflows/02-release.yaml
index d1b72248..d95308b7 100644
--- a/.github/workflows/02-release.yaml
+++ b/.github/workflows/02-release.yaml
@@ -16,6 +16,20 @@ jobs:
         with:
           SUB_STRING: "-rc"
   binary-build:
+    permissions:
+      actions: read
+      checks: read
+      contents: read
+      deployments: read
+      discussions: read
+      id-token: write
+      issues: read
+      packages: write
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      security-events: read
+      statuses: read
     needs: [retag]
     uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml
     with:
@@ -28,7 +42,19 @@ jobs:
     secrets: inherit
   create-release:
     permissions:
+      actions: read
+      checks: read
       contents: write
+      deployments: read
+      discussions: read
+      id-token: write
+      issues: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      statuses: read
+      security-events: read
     needs: [retag, binary-build]
     uses: ./.github/workflows/c-create-release.yaml
     with:
@@ -38,9 +64,19 @@ jobs:
     secrets: inherit
   publish-image:
     permissions:
-      id-token: write
-      packages: write
+      actions: read
+      checks: read
       contents: read
+      deployments: read
+      discussions: read
+      id-token: write
+      issues: read
+      packages: write
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      security-events: read
+      statuses: read
     uses: ./.github/workflows/d-publish-image.yaml
     needs: [create-release, retag]
     with:
diff --git a/.github/workflows/b-binary-build-and-e2e-tests.yaml b/.github/workflows/b-binary-build-and-e2e-tests.yaml
index 39b660aa..927e2845 100644
--- a/.github/workflows/b-binary-build-and-e2e-tests.yaml
+++ b/.github/workflows/b-binary-build-and-e2e-tests.yaml
@@ -277,6 +277,11 @@ jobs:
           if-no-files-found: error
 
   build-http-image:
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+      pull-requests: read
     needs: [check-secret]
     uses: kubescape/workflows/.github/workflows/incluster-comp-pr-merged.yaml@main
     with: