Add correct permissions to create a release. (#134)

* Add correct permissions to create a release. * Remove in-repo action and use shared action to configure gcloud and docker
UWIT-IAM · Apr 4, 2022 · 2b64f7b · 2b64f7b
1 parent 0736e53
commit 2b64f7b
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 36 deletions.
diff --git a/.github/actions/configure-docker/action.yml b/.github/actions/configure-docker/action.yml
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
@@ -32,12 +32,14 @@ jobs:
       cancel-in-progress: false
     permissions:
       id-token: write
-      contents: read
+      # https://docs.github.com/en/rest/reference/releases#create-a-release
+      # Creating "Release" artifacts falls under "contents: write"
+      contents: write
     steps:
       - uses: actions/checkout@v3
-      - uses: ./.github/actions/configure-docker
+      - uses: UWIT-IAM/actions/configure-gcloud-docker@0.1
         with:
-          gcr-token: ${{ secrets.GCR_TOKEN }}
+          gcloud-token: ${{ secrets.GCR_TOKEN }}
       - name: Install poetry
         uses: abatilo/[email protected]
       - run: |

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -35,9 +35,9 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - uses: abatilo/[email protected]
-      - uses: ./.github/actions/configure-docker
+      - uses: UWIT-IAM/actions/configure-gcloud-docker@0.1
         with:
-          gcr-token: ${{ secrets.GCR_TOKEN }}
+          gcloud-token: ${{ secrets.GCR_TOKEN }}
       - run: ./scripts/install-build-scripts.sh
         name: Install common-build-scripts
 

diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
@@ -49,9 +49,9 @@ jobs:
 
       - uses: abatilo/[email protected]
 
-      - uses: ./.github/actions/configure-docker
+      - uses: UWIT-IAM/actions/configure-gcloud-docker@0.1
         with:
-          gcr-token: ${{ secrets.GCR_TOKEN }}
+          gcloud-token: ${{ secrets.GCR_TOKEN }}
 
       - run: |
           poetry run pip install tox uw-it-build-fingerprinter

diff --git a/.github/workflows/scheduled-maintenance.yml b/.github/workflows/scheduled-maintenance.yml
@@ -18,9 +18,9 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - uses: abatilo/[email protected]
-      - uses: ./.github/actions/configure-docker
+      - uses: UWIT-IAM/actions/configure-gcloud-docker@0.1
         with:
-          gcr-token: ${{ secrets.GCR_TOKEN }}
+          gcloud-token: ${{ secrets.GCR_TOKEN }}
       - run: poetry update --lock
         id: poetry-update
       - run: poetry run tox