Really fix the permissions this time (#2341)

(I hope) Signed-off-by: Ben Cotton <[email protected]>
guacsec · Dec 5, 2024 · 9baf1f2 · 9baf1f2
1 parent 495c58e
commit 9baf1f2
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -175,6 +175,9 @@ jobs:
     name: generate provenance for binaries
     needs: [goreleaser]
     if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      contents: read
+      id-token: write
     uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] # must use semver here
     with:
       base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
@@ -185,6 +188,7 @@ jobs:
     needs: [goreleaser]
     if: startsWith(github.ref, 'refs/tags/')
     permissions:
+      contents: read
       id-token: write # To use our GitHub token
     uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] # must use semver here
     with: