github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-07-30 23:06:27 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #11326 from kata-containers/top-level-workflow-permissions

Browse Source 
Top level workflow permissions
This commit is contained in:
Steve Horsman 2025-05-29 10:03:06 +01:00 committed by GitHub
commit 3da213a8c8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
53 changed files with 280 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.github/workflows/PR-wip-checks.yaml vendored
View File

@ -9,6 +9,9 @@ on:
- labeled
- unlabeled
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

3
.github/workflows/actionlint.yaml vendored
View File

@ -11,6 +11,9 @@ on:
paths:
- '.github/workflows/**'
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

3
.github/workflows/basic-ci-amd64.yaml vendored
View File

@ -13,6 +13,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-cri-containerd:
strategy:

3
.github/workflows/basic-ci-s390x.yaml vendored
View File

@ -13,6 +13,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-cri-containerd:
strategy:

3
.github/workflows/build-checks-preview-riscv64.yaml vendored
View File

@ -12,6 +12,9 @@ on:
required: true
type: string
permissions:
contents: read
name: Build checks preview riscv64
jobs:
check:

3
.github/workflows/build-checks.yaml vendored
View File

@ -5,6 +5,9 @@ on:
required: true
type: string
permissions:
contents: read
name: Build checks
jobs:
check:

12
.github/workflows/build-kata-static-tarball-amd64.yaml vendored
View File

@ -21,6 +21,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
build-asset:
runs-on: ubuntu-22.04
@ -150,6 +153,9 @@ jobs:
build-asset-rootfs:
runs-on: ubuntu-22.04
needs: build-asset
permissions:
contents: read
packages: write
strategy:
matrix:
asset:
@ -247,6 +253,9 @@ jobs:
build-asset-shim-v2:
runs-on: ubuntu-22.04
needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
permissions:
contents: read
packages: write
steps:
- name: Login to Kata Containers quay.io
if: ${{ inputs.push-to-registry == 'yes' }}
@ -304,6 +313,9 @@ jobs:
create-kata-tarball:
runs-on: ubuntu-22.04
needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
with:

12
.github/workflows/build-kata-static-tarball-arm64.yaml vendored
View File

@ -21,6 +21,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
build-asset:
runs-on: ubuntu-22.04-arm
@ -130,6 +133,9 @@ jobs:
build-asset-rootfs:
runs-on: ubuntu-22.04-arm
needs: build-asset
permissions:
contents: read
packages: write
strategy:
matrix:
asset:
@ -219,6 +225,9 @@ jobs:
build-asset-shim-v2:
runs-on: ubuntu-22.04-arm
needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
permissions:
contents: read
packages: write
steps:
- name: Login to Kata Containers quay.io
if: ${{ inputs.push-to-registry == 'yes' }}
@ -274,6 +283,9 @@ jobs:
create-kata-tarball:
runs-on: ubuntu-22.04-arm
needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
with:

12
.github/workflows/build-kata-static-tarball-ppc64le.yaml vendored
View File

@ -21,6 +21,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
build-asset:
permissions:
@ -83,6 +86,9 @@ jobs:
build-asset-rootfs:
runs-on: ppc64le
needs: build-asset
permissions:
contents: read
packages: write
strategy:
matrix:
asset:
@ -158,6 +164,9 @@ jobs:
build-asset-shim-v2:
runs-on: ppc64le
needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
permissions:
contents: read
packages: write
steps:
- name: Login to Kata Containers quay.io
if: ${{ inputs.push-to-registry == 'yes' }}
@ -213,6 +222,9 @@ jobs:
create-kata-tarball:
runs-on: ppc64le
needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
permissions:
contents: read
packages: write
steps:
- name: Adjust a permission for repo
run: |

3
.github/workflows/build-kata-static-tarball-riscv64.yaml vendored
View File

@ -21,6 +21,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
build-asset:
runs-on: riscv-builder

15
.github/workflows/build-kata-static-tarball-s390x.yaml vendored
View File

@ -21,6 +21,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
build-asset:
runs-on: s390x
@ -112,6 +115,9 @@ jobs:
build-asset-rootfs:
runs-on: s390x
needs: build-asset
permissions:
contents: read
packages: write
strategy:
matrix:
asset:
@ -175,6 +181,9 @@ jobs:
build-asset-boot-image-se:
runs-on: s390x
needs: [build-asset, build-asset-rootfs]
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
@ -235,6 +244,9 @@ jobs:
build-asset-shim-v2:
runs-on: s390x
needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
permissions:
contents: read
packages: write
steps:
- name: Login to Kata Containers quay.io
if: ${{ inputs.push-to-registry == 'yes' }}
@ -296,6 +308,9 @@ jobs:
- build-asset-rootfs
- build-asset-boot-image-se
- build-asset-shim-v2
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
with:

3
.github/workflows/cargo-deny-runner.yaml vendored
View File

@ -11,6 +11,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
cargo-deny-runner:
runs-on: ubuntu-22.04

3
.github/workflows/ci-coco-stability.yaml vendored
View File

@ -8,6 +8,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
kata-containers-ci-on-push:
permissions:

3
.github/workflows/ci-devel.yaml vendored
View File

@ -2,6 +2,9 @@ name: Kata Containers CI (manually triggered)
on:
workflow_dispatch:
permissions:
contents: read
jobs:
kata-containers-ci-on-push:
permissions:

4
.github/workflows/ci-nightly-s390x.yaml vendored
View File

@ -3,6 +3,10 @@ on:
- cron: '0 5 * * *'
name: Nightly CI for s390x
permissions:
contents: read
jobs:
check-internal-test-result:
runs-on: s390x

3
.github/workflows/ci-nightly.yaml vendored
View File

@ -7,6 +7,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
kata-containers-ci-on-push:
permissions:

3
.github/workflows/ci-on-push.yaml vendored
View File

@ -14,6 +14,9 @@ on:
- reopened
- labeled
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

14
.github/workflows/ci-weekly.yaml vendored
View File

@ -16,8 +16,16 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
build-kata-static-tarball-amd64:
permissions:
contents: read
packages: write
id-token: write
attestations: write
uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -26,6 +34,9 @@ jobs:
publish-kata-deploy-payload-amd64:
needs: build-kata-static-tarball-amd64
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-kata-deploy-payload.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -39,6 +50,9 @@ jobs:
secrets: inherit
build-and-publish-tee-confidential-unencrypted-image:
permissions:
contents: read
packages: write
runs-on: ubuntu-22.04
steps:
- name: Checkout code

41
.github/workflows/ci.yaml vendored
View File

@ -20,8 +20,16 @@ on:
type: string
default: no
permissions:
contents: read
jobs:
build-kata-static-tarball-amd64:
permissions:
contents: read
packages: write
id-token: write
attestations: write
uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -30,6 +38,9 @@ jobs:
publish-kata-deploy-payload-amd64:
needs: build-kata-static-tarball-amd64
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-kata-deploy-payload.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -43,6 +54,11 @@ jobs:
secrets: inherit
build-kata-static-tarball-arm64:
permissions:
contents: read
packages: write
id-token: write
attestations: write
uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -51,6 +67,9 @@ jobs:
publish-kata-deploy-payload-arm64:
needs: build-kata-static-tarball-arm64
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-kata-deploy-payload.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -64,6 +83,11 @@ jobs:
secrets: inherit
build-kata-static-tarball-s390x:
permissions:
contents: read
packages: write
id-token: write
attestations: write
uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -72,6 +96,9 @@ jobs:
secrets: inherit
build-kata-static-tarball-ppc64le:
permissions:
contents: read
packages: write
uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -79,6 +106,11 @@ jobs:
target-branch: ${{ inputs.target-branch }}
build-kata-static-tarball-riscv64:
permissions:
contents: read
packages: write
id-token: write
attestations: write
uses: ./.github/workflows/build-kata-static-tarball-riscv64.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -88,6 +120,9 @@ jobs:
publish-kata-deploy-payload-s390x:
needs: build-kata-static-tarball-s390x
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-kata-deploy-payload.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -102,6 +137,9 @@ jobs:
publish-kata-deploy-payload-ppc64le:
needs: build-kata-static-tarball-ppc64le
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-kata-deploy-payload.yaml
with:
tarball-suffix: -${{ inputs.tag }}
@ -115,6 +153,9 @@ jobs:
secrets: inherit
build-and-publish-tee-confidential-unencrypted-image:
permissions:
contents: read
packages: write
runs-on: ubuntu-22.04
steps:
- name: Checkout code

3
.github/workflows/cleanup-resources.yaml vendored
View File

@ -4,6 +4,9 @@ on:
- cron: "0 0 * * *"
workflow_dispatch:
permissions:
contents: read
jobs:
cleanup-resources:
runs-on: ubuntu-22.04

3
.github/workflows/codeql.yml vendored
View File

@ -19,6 +19,9 @@ on:
schedule:
- cron: '45 0 * * 1'
permissions:
contents: read
jobs:
analyze:
name: Analyze (${{ matrix.language }})

3
.github/workflows/commit-message-check.yaml vendored
View File

@ -6,6 +6,9 @@ on:
- reopened
- synchronize
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

3
.github/workflows/darwin-tests.yaml vendored
View File

@ -6,6 +6,9 @@ on:
- reopened
- synchronize
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

3
.github/workflows/docs-url-alive-check.yaml vendored
View File

@ -2,6 +2,9 @@ on:
schedule:
- cron: '0 23 * * 0'
permissions:
contents: read
name: Docs URL Alive Check
jobs:
test:

2
.github/workflows/gatekeeper-skipper.yaml vendored
View File

@ -31,6 +31,8 @@ on:
skip_static:
value: ${{ jobs.skipper.outputs.skip_static }}
permissions:
contents: read
jobs:
skipper:

4
.github/workflows/gatekeeper.yaml vendored
View File

@ -12,6 +12,9 @@ on:
- reopened
- labeled
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
@ -23,6 +26,7 @@ jobs:
actions: read
contents: read
issues: read
pull-requests: read
steps:
- uses: actions/checkout@v4
with:

3
.github/workflows/kata-runtime-classes-sync.yaml vendored
View File

@ -6,6 +6,9 @@ on:
- reopened
- synchronize
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

18
.github/workflows/payload-after-push.yaml vendored
View File

@ -5,6 +5,9 @@ on:
- main
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@ -61,6 +64,9 @@ jobs:
publish-kata-deploy-payload-amd64:
needs: build-assets-amd64
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-kata-deploy-payload.yaml
with:
commit-hash: ${{ github.sha }}
@ -74,6 +80,9 @@ jobs:
publish-kata-deploy-payload-arm64:
needs: build-assets-arm64
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-kata-deploy-payload.yaml
with:
commit-hash: ${{ github.sha }}
@ -87,6 +96,9 @@ jobs:
publish-kata-deploy-payload-s390x:
needs: build-assets-s390x
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-kata-deploy-payload.yaml
with:
commit-hash: ${{ github.sha }}
@ -100,6 +112,9 @@ jobs:
publish-kata-deploy-payload-ppc64le:
needs: build-assets-ppc64le
permissions:
contents: read
packages: write
uses: ./.github/workflows/publish-kata-deploy-payload.yaml
with:
commit-hash: ${{ github.sha }}
@ -113,6 +128,9 @@ jobs:
publish-manifest:
runs-on: ubuntu-22.04
permissions:
contents: read
packages: write
needs: [publish-kata-deploy-payload-amd64, publish-kata-deploy-payload-arm64, publish-kata-deploy-payload-s390x, publish-kata-deploy-payload-ppc64le]
steps:
- name: Checkout repository

6
.github/workflows/publish-kata-deploy-payload.yaml vendored
View File

@ -31,8 +31,14 @@ on:
required: true
type: string
permissions:
contents: read
jobs:
kata-payload:
permissions:
contents: read
packages: write
runs-on: ${{ inputs.runner }}
steps:
- uses: actions/checkout@v4

6
.github/workflows/release-amd64.yaml vendored
View File

@ -6,6 +6,9 @@ on:
required: true
type: string
permissions:
contents: read
jobs:
build-kata-static-tarball-amd64:
uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
@ -16,6 +19,9 @@ jobs:
kata-deploy:
needs: build-kata-static-tarball-amd64
permissions:
contents: read
packages: write
runs-on: ubuntu-22.04
steps:
- name: Login to Kata Containers docker.io

6
.github/workflows/release-arm64.yaml vendored
View File

@ -6,6 +6,9 @@ on:
required: true
type: string
permissions:
contents: read
jobs:
build-kata-static-tarball-arm64:
uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
@ -16,6 +19,9 @@ jobs:
kata-deploy:
needs: build-kata-static-tarball-arm64
permissions:
contents: read
packages: write
runs-on: ubuntu-22.04-arm
steps:
- name: Login to Kata Containers docker.io

6
.github/workflows/release-ppc64le.yaml vendored
View File

@ -6,6 +6,9 @@ on:
required: true
type: string
permissions:
contents: read
jobs:
build-kata-static-tarball-ppc64le:
uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
@ -16,6 +19,9 @@ jobs:
kata-deploy:
needs: build-kata-static-tarball-ppc64le
permissions:
contents: read
packages: write
runs-on: ppc64le
steps:
- name: Login to Kata Containers docker.io

6
.github/workflows/release-s390x.yaml vendored
View File

@ -6,6 +6,9 @@ on:
required: true
type: string
permissions:
contents: read
jobs:
build-kata-static-tarball-s390x:
uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
@ -16,6 +19,9 @@ jobs:
kata-deploy:
needs: build-kata-static-tarball-s390x
permissions:
contents: read
packages: write
runs-on: s390x
steps:
- name: Login to Kata Containers docker.io

3
.github/workflows/release.yaml vendored
View File

@ -2,6 +2,9 @@ name: Release Kata Containers
on:
workflow_dispatch
permissions:
contents: read
jobs:
release:
runs-on: ubuntu-22.04

4
.github/workflows/run-cri-containerd-tests-ppc64le.yaml vendored
View File

@ -1,4 +1,8 @@
name: CI | Run cri-containerd tests on ppc64le
permissions:
contents: read
on:
workflow_call:
inputs:

3
.github/workflows/run-k8s-tests-on-aks.yaml vendored
View File

@ -25,6 +25,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-k8s-tests:
strategy:

3
.github/workflows/run-k8s-tests-on-amd64.yaml vendored
View File

@ -22,6 +22,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-k8s-tests-amd64:
strategy:

3
.github/workflows/run-k8s-tests-on-arm64.yaml vendored
View File

@ -22,6 +22,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-k8s-tests-on-arm64:
strategy:

3
.github/workflows/run-k8s-tests-on-ppc64le.yaml vendored
View File

@ -22,6 +22,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-k8s-tests:
strategy:

3
.github/workflows/run-k8s-tests-on-zvsi.yaml vendored
View File

@ -22,6 +22,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-k8s-tests:
strategy:

3
.github/workflows/run-kata-coco-stability-tests.yaml vendored
View File

@ -25,6 +25,9 @@ on:
required: false
type: string
permissions:
contents: read
jobs:
# Generate jobs for testing CoCo on non-TEE environments
run-stability-k8s-tests-coco-nontee:

3
.github/workflows/run-kata-coco-tests.yaml vendored
View File

@ -25,6 +25,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-k8s-tests-on-tdx:
strategy:

3
.github/workflows/run-kata-deploy-tests-on-aks.yaml vendored
View File

@ -22,6 +22,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-kata-deploy-tests:
strategy:

3
.github/workflows/run-kata-deploy-tests.yaml vendored
View File

@ -22,6 +22,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-kata-deploy-tests:
strategy:

3
.github/workflows/run-kata-monitor-tests.yaml vendored
View File

@ -13,6 +13,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-monitor:
strategy:

3
.github/workflows/run-metrics.yaml vendored
View File

@ -22,6 +22,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-metrics:
strategy:

3
.github/workflows/run-runk-tests.yaml vendored
View File

@ -13,6 +13,9 @@ on:
type: string
default: ""
permissions:
contents: read
jobs:
run-runk:
# Skip runk tests as we have no maintainers. TODO: Decide when to remove altogether

3
.github/workflows/shellcheck.yaml vendored
View File

@ -10,6 +10,9 @@ on:
- reopened
- synchronize
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

3
.github/workflows/shellcheck_required.yaml vendored
View File

@ -11,6 +11,9 @@ on:
- reopened
- synchronize
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

3
.github/workflows/stale.yaml vendored
View File

@ -4,6 +4,9 @@ on:
- cron: '0 0 * * *'
workflow_dispatch:
permissions:
contents: read
jobs:
stale:
runs-on: ubuntu-22.04

3
.github/workflows/static-checks-self-hosted.yaml vendored
View File

@ -6,6 +6,9 @@ on:
- reopened
- labeled # a workflow runs only when the 'ok-to-test' label is added
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

3
.github/workflows/static-checks.yaml vendored
View File

@ -6,6 +6,9 @@ on:
- reopened
- synchronize
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

4
src/runtime/pkg/govmm/.github/workflows/main.yml vendored
View File

@ -1,5 +1,9 @@
on: ["pull_request"]
name: Unit tests
permissions:
contents: read
jobs:
test:
strategy: