From c01835945b63e3e49cb34641c9417048343c121f Mon Sep 17 00:00:00 2001 From: Adam Vollrath Date: Thu, 4 Jan 2024 10:59:41 -0600 Subject: [PATCH] Limit permissions of GHA token in Uffizzi second stage workflow. Signed-off-by: Adam Vollrath --- .github/workflows/uffizzi-preview.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/uffizzi-preview.yaml b/.github/workflows/uffizzi-preview.yaml index cd1f6f939c..93c42e6c71 100644 --- a/.github/workflows/uffizzi-preview.yaml +++ b/.github/workflows/uffizzi-preview.yaml @@ -12,6 +12,8 @@ jobs: name: Cache Manifests File runs-on: ubuntu-latest if: ${{ github.event.workflow_run.conclusion == 'success' }} + permissions: + actions: read outputs: manifests-cache-key: ${{ steps.hash.outputs.MANIFESTS_FILE_HASH }} git-ref: ${{ steps.event.outputs.GIT_REF }} @@ -84,14 +86,14 @@ jobs: cat event.json deploy-uffizzi-preview: - permissions: - contents: read - pull-requests: write - id-token: write name: Deploy to Uffizzi Virtual Cluster needs: - cache-manifests-file if: ${{ github.event.workflow_run.conclusion == 'success' && needs.cache-manifests-file.outputs.action != 'closed' }} + permissions: + contents: read + pull-requests: write + id-token: write runs-on: ubuntu-latest steps: - name: Checkout