fix: add correct permissions to build job

ln-markets · Nov 9, 2023 · 3609371 · 3609371
1 parent 378dce5
commit 3609371
Show file tree

Hide file tree

Showing 24 changed files with 208 additions and 52 deletions.
diff --git a/.github/workflows/base-alpine.yml b/.github/workflows/base-alpine.yml
@@ -11,7 +11,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/base-alpine

diff --git a/.github/workflows/base-node.yml b/.github/workflows/base-node.yml
@@ -11,7 +11,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/base-node

diff --git a/.github/workflows/bitcoin-regtest.yml b/.github/workflows/bitcoin-regtest.yml
@@ -16,7 +16,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/bitcoin-regtest

diff --git a/.github/workflows/bitcoin.yml b/.github/workflows/bitcoin.yml
@@ -16,7 +16,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/bitcoin

diff --git a/.github/workflows/bp-core.yml b/.github/workflows/bp-core.yml
@@ -56,7 +56,10 @@ jobs:
   build-release:
     needs: prepare
     if: ${{ (github.event_name == 'push' || github.event.inputs.target == 'release') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted
@@ -66,7 +69,10 @@ jobs:
   build-nightly:
     needs: prepare
     if: ${{ (github.event_name == 'schedule' || github.event.inputs.target == 'nightly') && (github.event.inputs.force || needs.prepare.outputs.tag-commit-exists == 'false') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted
@@ -76,15 +82,21 @@ jobs:
 
   build-lnpbp-tools-release:
     needs: build-release
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools
       target: release
 
   build-lnpbp-tools-nightly:
     needs: build-nightly
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools

diff --git a/.github/workflows/bp-descriptor-wallet.yml b/.github/workflows/bp-descriptor-wallet.yml
@@ -56,7 +56,10 @@ jobs:
   build-release:
     needs: prepare
     if: ${{ (github.event_name == 'push' || github.event.inputs.target == 'release') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted
@@ -66,7 +69,10 @@ jobs:
   build-nightly:
     needs: prepare
     if: ${{ (github.event_name == 'schedule' || github.event.inputs.target == 'nightly') && (github.event.inputs.force || needs.prepare.outputs.tag-commit-exists == 'false') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted
@@ -76,15 +82,21 @@ jobs:
 
   build-lnpbp-tools-release:
     needs: build-release
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools
       target: release
 
   build-lnpbp-tools-nightly:
     needs: build-nightly
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools

diff --git a/.github/workflows/bp-node.yml b/.github/workflows/bp-node.yml
@@ -56,7 +56,10 @@ jobs:
   build-release:
     needs: prepare
     if: ${{ (github.event_name == 'push' || github.event.inputs.target == 'release') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted
@@ -66,7 +69,10 @@ jobs:
   build-nightly:
     needs: prepare
     if: ${{ (github.event_name == 'schedule' || github.event.inputs.target == 'nightly') && (github.event.inputs.force || needs.prepare.outputs.tag-commit-exists == 'false') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted
@@ -76,15 +82,21 @@ jobs:
 
   build-lnpbp-tools-release:
     needs: build-release
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools
       target: release
 
   build-lnpbp-tools-nightly:
     needs: build-nightly
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools

diff --git a/.github/workflows/faraday.yml b/.github/workflows/faraday.yml
@@ -16,7 +16,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/faraday

diff --git a/.github/workflows/lightning-terminal.yml b/.github/workflows/lightning-terminal.yml
@@ -16,7 +16,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lightning-terminal

diff --git a/.github/workflows/lnd.yml b/.github/workflows/lnd.yml
@@ -56,7 +56,10 @@ jobs:
   build-release:
     needs: prepare
     if: ${{ (github.event_name == 'push' || github.event.inputs.target == 'release') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnd
@@ -65,7 +68,10 @@ jobs:
   build-nightly:
     needs: prepare
     if: ${{ github.event.inputs.force || ((github.event_name == 'schedule' || github.event.inputs.target == 'nightly') && needs.prepare.outputs.tag-commit-exists == 'false') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnd

diff --git a/.github/workflows/lndmon.yml b/.github/workflows/lndmon.yml
@@ -16,7 +16,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lndmon

diff --git a/.github/workflows/lnp-node.yml b/.github/workflows/lnp-node.yml
@@ -56,7 +56,10 @@ jobs:
   build-release:
     needs: prepare
     if: ${{ (github.event_name == 'push' || github.event.inputs.target == 'release') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted
@@ -66,7 +69,10 @@ jobs:
   build-nightly:
     needs: prepare
     if: ${{ (github.event_name == 'schedule' || github.event.inputs.target == 'nightly') && (github.event.inputs.force || needs.prepare.outputs.tag-commit-exists == 'false') }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted
@@ -76,15 +82,21 @@ jobs:
 
   build-lnpbp-tools-release:
     needs: build-release
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools
       target: release
 
   build-lnpbp-tools-nightly:
     needs: build-nightly
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools

diff --git a/.github/workflows/lnpbp-tools.yml b/.github/workflows/lnpbp-tools.yml
@@ -13,15 +13,21 @@ on:
 jobs:
   build-release:
     if: ${{ github.event.inputs.target == 'release' }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools
       target: release
 
   build-nightly:
     if: ${{ github.event.inputs.target == 'nightly' }}
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/lnpbp-tools

diff --git a/.github/workflows/loop.yml b/.github/workflows/loop.yml
@@ -16,7 +16,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/loop

diff --git a/.github/workflows/nostr-rs-relay.yml b/.github/workflows/nostr-rs-relay.yml
@@ -16,7 +16,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted

diff --git a/.github/workflows/nostream.yml b/.github/workflows/nostream.yml
@@ -16,7 +16,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       runs-on: self-hosted

diff --git a/.github/workflows/pool.yml b/.github/workflows/pool.yml
@@ -16,7 +16,10 @@ on:
 
 jobs:
   build:
-    uses: ./.github/workflows/bake.yml
+    uses: ./.github/workflows/bake.yml    
+    permissions:
+      contents: read
+      packages: write
     secrets: inherit
     with:
       path: docker/pool