ci: Ensure workflow callers to workflow_run describe permissions (#5164)

.github/workflows/approval-comment.yaml

@@ -2,7 +2,6 @@ name: ApprovalComment
 on:
   pull_request_review:
     types: [submitted]
-
 jobs:
   approval-comment:
     if: startsWith(github.event.review.body, '/karpenter snapshot') || startsWith(github.event.review.body, '/karpenter scale') || startsWith(github.event.review.body, '/karpenter versionCompatibility')

.github/workflows/codegen.yaml

@@ -2,12 +2,12 @@ name: "APICodeGen"
 on:
   schedule:
     - cron: '0 13 * * MON'
-permissions:
-  id-token: write # aws-actions/[email protected]
-  pull-requests: write # name: Create Pull Request
-  contents: write # name: Create Pull Request
 jobs:
   codegen:
+    permissions:
+      id-token: write # aws-actions/[email protected]
+      pull-requests: write # name: Create Pull Request
+      contents: write # name: Create Pull Request
     if: github.repository == 'aws/karpenter'
     runs-on: ubuntu-latest
     steps:

.github/workflows/codeql-analysis.yaml

@@ -1,13 +1,11 @@
 name: "CodeQL"
-
 on:
   push:
     branches:
       - 'main'
       - 'release-v*'
   schedule:
     - cron: '0 12 * * *'
-
 jobs:
   analyze:
     if: github.repository == 'aws/karpenter'

.github/workflows/docgen.yaml

@@ -1,16 +1,13 @@
 name: DocGenCI
-
 on:
   push:
     branches:
       - 'main'
       - 'release-v*'
-
-permissions:
-  id-token: write # aws-actions/[email protected]
-
 jobs:
   docgen-ci:
+    permissions:
+      id-token: write # aws-actions/[email protected]
     if: github.repository == 'aws/karpenter'
     runs-on: ubuntu-latest
     steps:

.github/workflows/e2e-cleanup.yaml

@@ -14,10 +14,10 @@ on:
           - "us-east-2"
           - "us-west-2"
           - "eu-west-1"
-permissions:
-  id-token: write # aws-actions/[email protected]
 jobs:
   cleanup:
+    permissions:
+      id-token: write # aws-actions/[email protected]
     name: cleanup-${{ inputs.cluster_name }}
     runs-on: ubuntu-latest
     steps:

.github/workflows/e2e-matrix-trigger.yaml

@@ -31,6 +31,9 @@ jobs:
     with:
       allowed_comment: "snapshot"
   e2e-matrix:
+    permissions:
+      id-token: write # aws-actions/[email protected]
+      statuses: write # ./.github/actions/commit-status/start
     needs: [resolve]
     if: needs.resolve.outputs.SHOULD_RUN == 'true'
     uses: ./.github/workflows/e2e-matrix.yaml

.github/workflows/e2e-matrix.yaml

@@ -51,6 +51,9 @@ on:
 #   3. Downstream fork triggered the job through dispatch and has set 'ENABLE_E2E' in repo environment variables
 jobs:
   e2e:
+    permissions:
+      id-token: write # aws-actions/[email protected]
+      statuses: write # ./.github/actions/commit-status/start
     strategy:
       fail-fast: false
       max-parallel: ${{ inputs.parallelism || 100 }}
@@ -75,6 +78,9 @@ jobs:
     secrets:
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   e2e-upgrade:
+    permissions:
+      id-token: write # aws-actions/[email protected]
+      statuses: write # ./.github/actions/commit-status/start
     uses: ./.github/workflows/e2e-upgrade.yaml
     with:
       # This version matches the steps of the newest version that contains the additional step

.github/workflows/e2e-scale-trigger.yaml

@@ -29,6 +29,9 @@ jobs:
     with:
       allowed_comment: "scale"
   scale:
+    permissions:
+      id-token: write # aws-actions/[email protected]
+      statuses: write # ./.github/actions/commit-status/start
     needs: [resolve]
     if: needs.resolve.outputs.SHOULD_RUN == 'true'
     uses: ./.github/workflows/e2e.yaml

.github/workflows/e2e-upgrade.yaml

@@ -48,11 +48,11 @@ on:
     secrets:
       SLACK_WEBHOOK_URL:
         required: true
-permissions:
-  id-token: write # aws-actions/[email protected]
-  statuses: write # ./.github/actions/commit-status/start
 jobs:
   run-suite:
+    permissions:
+      id-token: write # aws-actions/[email protected]
+      statuses: write # ./.github/actions/commit-status/start
     name: suite-upgrade
     runs-on: ubuntu-latest
     steps:

.github/workflows/e2e-version-compatibility-trigger.yaml

@@ -26,6 +26,9 @@ jobs:
     with:
       allowed_comment: "versionCompatibility"
   versionCompatibility:
+    permissions:
+      id-token: write # aws-actions/[email protected]
+      statuses: write # ./.github/actions/commit-status/start
     needs: [resolve]
     if: needs.resolve.outputs.SHOULD_RUN == 'true'
     strategy:

.github/workflows/e2e.yaml

@@ -67,11 +67,11 @@ on:
     secrets:
       SLACK_WEBHOOK_URL:
         required: true
-permissions:
-  id-token: write # aws-actions/[email protected]
-  statuses: write # ./.github/actions/commit-status/start
 jobs:
   run-suite:
+    permissions:
+      id-token: write # aws-actions/[email protected]
+      statuses: write # ./.github/actions/commit-status/start
     name: suite-${{ inputs.suite }}
     runs-on: ubuntu-latest
     steps:

.github/workflows/pr-snapshot.yaml

@@ -3,12 +3,12 @@ on:
   workflow_run:
     workflows: [ApprovalComment]
     types: [completed]
-permissions:
-  id-token: write
-  pull-requests: write
-  statuses: write
 jobs:
   release:
+    permissions:
+      id-token: write
+      pull-requests: write
+      statuses: write
     if: github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     steps:

.github/workflows/publish-test-tools.yaml

@@ -9,10 +9,10 @@ on:
       - test/push-docker.sh
   schedule:
     - cron: '0 13 * * MON'
-permissions:
-  id-token: write # aws-actions/[email protected]
 jobs:
   publish-tools:
+    permissions:
+      id-token: write # aws-actions/[email protected]
     if: github.repository == 'aws/karpenter'
     runs-on: ubuntu-latest
     steps:

.github/workflows/release.yaml

@@ -7,12 +7,12 @@ on:
       - 'v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+'
       - 'v[0-9]+.[0-9]+.[0-9]+-alpha.[0-9]+'
       - 'v[0-9]+.[0-9]+.[0-9]+-beta.[0-9]+'
-permissions:
-  id-token: write # aws-actions/[email protected]
-  contents: write # marvinpinto/[email protected]
-  pull-requests: write # name: Create PR
 jobs:
   release:
+    permissions:
+      id-token: write # aws-actions/[email protected]
+      contents: write # marvinpinto/[email protected]
+      pull-requests: write # name: Create PR
     if: github.repository == 'aws/karpenter'
     runs-on: ubuntu-latest
     steps:

.github/workflows/snapshot.yaml

@@ -4,10 +4,10 @@ on:
     branches:
       - 'main'
       - 'release-v*'
-permissions:
-  id-token: write # aws-actions/[email protected]
 jobs:
   release:
+    permissions:
+      id-token: write # aws-actions/[email protected]
     if: github.repository == 'aws/karpenter'
     runs-on: ubuntu-latest
     steps:

.github/workflows/sweeper.yaml

@@ -3,10 +3,10 @@ on:
   schedule:
     - cron: '0 */12 * * *'
   workflow_dispatch:
-permissions:
-  id-token: write # aws-actions/[email protected]
 jobs:
   sweeper:
+    permissions:
+      id-token: write # aws-actions/[email protected]
     if: vars.ACCOUNT_ID != '' || github.event_name == 'workflow_dispatch'
     strategy:
       fail-fast: false