fix: token permission in Installer scheduled tests (#407)

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

Signed-off-by: laurentsimon <laurentsimon@google.com>

.github/workflows/schedule.installer.yml

@@ -13,7 +13,7 @@ on:
 permissions: read-all
 
 env:
-  GH_TOKEN: ${{ secrets.CREATE_ISSUES }}
+  GH_TOKEN: ${{ github.token }}
   ISSUE_REPOSITORY: ${{ github.repository }}
   MINIMUM_INSTALLER_VERSION: v2.0.1
 
@@ -188,10 +188,13 @@ jobs:
           [ "$SUCCESS" == "true" ]
 
   if-succeed:
-    needs: [verifier-run]
+    needs: [verifier-run, list-verifiers]
     runs-on: ubuntu-latest
     # We use `== 'failure'` instead of ` != 'success'` because we want to ignore skipped jobs, if there are any.
-    if: always() && inputs.version == '' && needs.verifier-run.result != 'failure'
+    if: inputs.version == '' && needs.verifier-run.result != 'failure' && needs.list-verifiers.result != 'failure'
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # tag=v2.4.0
         with:
@@ -200,10 +203,12 @@ jobs:
       - run: ./.github/workflows/scripts/e2e-report-success.sh
 
   if-failed:
-
-    needs: [verifier-run]
+    needs: [verifier-run, list-verifiers]
     runs-on: ubuntu-latest
-    if: always() && inputs.version == '' && needs.verifier-run.result == 'failure'
+    if: always() && inputs.version == '' && (needs.verifier-run.result == 'failure' || needs.list-verifiers.result == 'failure')
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # tag=v2.4.0
         with:

.github/workflows/scripts/schedule.actions/verifier-installer.sh

@@ -8,8 +8,7 @@ minimum_version="$MINIMUM_INSTALLER_VERSION"
 list=""
 # Check the releases.
 echo "Listing releases"
-# Note: can remove -R option.
-release_list=$(gh -R slsa-framework/slsa-verifier release list)
+release_list=$(gh release list)
 while read -r line; do
     tag=$(echo "$line" | cut -f1)
     if version_ge "$tag" "$minimum_version"; then