workflows: Add explicit permissions where needed

We have a number of jobs that either need,or nest workflows
that need gh permissions, such as for pushing to ghcr,
or doing attest build provenance. This means they need write
permissions on things like `packages`, `id-token` and `attestations`,
so we need to set these permissions at the job-level
(along with `contents: read`), so they are not restricted by our
safe defaults.

Signed-off-by: stevenhorsman <steven@uk.ibm.com>

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -153,6 +153,9 @@ jobs:
   build-asset-rootfs:
     runs-on: ubuntu-22.04
     needs: build-asset
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         asset:
@@ -250,6 +253,9 @@ jobs:
   build-asset-shim-v2:
     runs-on: ubuntu-22.04
     needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Login to Kata Containers quay.io
         if: ${{ inputs.push-to-registry == 'yes' }}
@@ -307,6 +313,9 @@ jobs:
   create-kata-tarball:
     runs-on: ubuntu-22.04
     needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/build-kata-static-tarball-arm64.yaml

@@ -133,6 +133,9 @@ jobs:
   build-asset-rootfs:
     runs-on: ubuntu-22.04-arm
     needs: build-asset
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         asset:
@@ -222,6 +225,9 @@ jobs:
   build-asset-shim-v2:
     runs-on: ubuntu-22.04-arm
     needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Login to Kata Containers quay.io
         if: ${{ inputs.push-to-registry == 'yes' }}
@@ -277,6 +283,9 @@ jobs:
   create-kata-tarball:
     runs-on: ubuntu-22.04-arm
     needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/build-kata-static-tarball-ppc64le.yaml

@@ -86,6 +86,9 @@ jobs:
   build-asset-rootfs:
     runs-on: ppc64le
     needs: build-asset
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         asset:
@@ -161,6 +164,9 @@ jobs:
   build-asset-shim-v2:
     runs-on: ppc64le
     needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Login to Kata Containers quay.io
         if: ${{ inputs.push-to-registry == 'yes' }}
@@ -216,6 +222,9 @@ jobs:
   create-kata-tarball:
     runs-on: ppc64le
     needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Adjust a permission for repo
         run: |

.github/workflows/build-kata-static-tarball-s390x.yaml

@@ -115,6 +115,9 @@ jobs:
   build-asset-rootfs:
     runs-on: s390x
     needs: build-asset
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         asset:
@@ -178,6 +181,9 @@ jobs:
   build-asset-boot-image-se:
     runs-on: s390x
     needs: [build-asset, build-asset-rootfs]
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
 
@@ -238,6 +244,9 @@ jobs:
   build-asset-shim-v2:
     runs-on: s390x
     needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Login to Kata Containers quay.io
         if: ${{ inputs.push-to-registry == 'yes' }}
@@ -299,6 +308,9 @@ jobs:
       - build-asset-rootfs
       - build-asset-boot-image-se
       - build-asset-shim-v2
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/ci-weekly.yaml

@@ -21,6 +21,11 @@ permissions:
 
 jobs:
   build-kata-static-tarball-amd64:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -29,6 +34,9 @@ jobs:
 
   publish-kata-deploy-payload-amd64:
     needs: build-kata-static-tarball-amd64
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-kata-deploy-payload.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -42,6 +50,9 @@ jobs:
     secrets: inherit
 
   build-and-publish-tee-confidential-unencrypted-image:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout code

.github/workflows/ci.yaml

@@ -25,6 +25,11 @@ permissions:
 
 jobs:
   build-kata-static-tarball-amd64:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -33,6 +38,9 @@ jobs:
 
   publish-kata-deploy-payload-amd64:
     needs: build-kata-static-tarball-amd64
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-kata-deploy-payload.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -46,6 +54,11 @@ jobs:
     secrets: inherit
 
   build-kata-static-tarball-arm64:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -54,6 +67,9 @@ jobs:
 
   publish-kata-deploy-payload-arm64:
     needs: build-kata-static-tarball-arm64
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-kata-deploy-payload.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -67,6 +83,11 @@ jobs:
     secrets: inherit
 
   build-kata-static-tarball-s390x:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -75,6 +96,9 @@ jobs:
     secrets: inherit
 
   build-kata-static-tarball-ppc64le:
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -82,6 +106,11 @@ jobs:
       target-branch: ${{ inputs.target-branch }}
 
   build-kata-static-tarball-riscv64:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     uses: ./.github/workflows/build-kata-static-tarball-riscv64.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -91,6 +120,9 @@ jobs:
 
   publish-kata-deploy-payload-s390x:
     needs: build-kata-static-tarball-s390x
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-kata-deploy-payload.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -105,6 +137,9 @@ jobs:
 
   publish-kata-deploy-payload-ppc64le:
     needs: build-kata-static-tarball-ppc64le
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-kata-deploy-payload.yaml
     with:
       tarball-suffix: -${{ inputs.tag }}
@@ -118,6 +153,9 @@ jobs:
     secrets: inherit
 
   build-and-publish-tee-confidential-unencrypted-image:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout code

.github/workflows/gatekeeper.yaml

@@ -26,6 +26,7 @@ jobs:
       actions: read
       contents: read
       issues: read
+      pull-requests: read
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/payload-after-push.yaml

@@ -64,6 +64,9 @@ jobs:
 
   publish-kata-deploy-payload-amd64:
     needs: build-assets-amd64
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-kata-deploy-payload.yaml
     with:
       commit-hash: ${{ github.sha }}
@@ -77,6 +80,9 @@ jobs:
 
   publish-kata-deploy-payload-arm64:
     needs: build-assets-arm64
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-kata-deploy-payload.yaml
     with:
       commit-hash: ${{ github.sha }}
@@ -90,6 +96,9 @@ jobs:
 
   publish-kata-deploy-payload-s390x:
     needs: build-assets-s390x
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-kata-deploy-payload.yaml
     with:
       commit-hash: ${{ github.sha }}
@@ -103,6 +112,9 @@ jobs:
 
   publish-kata-deploy-payload-ppc64le:
     needs: build-assets-ppc64le
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/publish-kata-deploy-payload.yaml
     with:
       commit-hash: ${{ github.sha }}
@@ -116,6 +128,9 @@ jobs:
 
   publish-manifest:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      packages: write
     needs: [publish-kata-deploy-payload-amd64, publish-kata-deploy-payload-arm64, publish-kata-deploy-payload-s390x, publish-kata-deploy-payload-ppc64le]
     steps:
       - name: Checkout repository

.github/workflows/publish-kata-deploy-payload.yaml

@@ -36,6 +36,9 @@ permissions:
 
 jobs:
   kata-payload:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ${{ inputs.runner }}
     steps:
       - uses: actions/checkout@v4

.github/workflows/release-amd64.yaml

@@ -19,6 +19,9 @@ jobs:
 
   kata-deploy:
     needs: build-kata-static-tarball-amd64
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-22.04
     steps:
       - name: Login to Kata Containers docker.io

.github/workflows/release-arm64.yaml

@@ -19,6 +19,9 @@ jobs:
 
   kata-deploy:
     needs: build-kata-static-tarball-arm64
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-22.04-arm
     steps:
       - name: Login to Kata Containers docker.io

.github/workflows/release-ppc64le.yaml

@@ -19,6 +19,9 @@ jobs:
 
   kata-deploy:
     needs: build-kata-static-tarball-ppc64le
+    permissions:
+      contents: read
+      packages: write
     runs-on: ppc64le
     steps:
       - name: Login to Kata Containers docker.io

.github/workflows/release-s390x.yaml

@@ -19,6 +19,9 @@ jobs:
 
   kata-deploy:
     needs: build-kata-static-tarball-s390x
+    permissions:
+      contents: read
+      packages: write
     runs-on: s390x
     steps:
       - name: Login to Kata Containers docker.io