ci: update permissions

motech-development · Nov 28, 2024 · b41582d · b41582d
1 parent 85b4cf6
commit b41582d
Showing 1 changed file with 40 additions and 0 deletions.
diff --git a/.github/workflows/deploy-to-environment.yml b/.github/workflows/deploy-to-environment.yml
@@ -92,6 +92,10 @@ jobs:
       STAGE: develop
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2
@@ -170,6 +174,10 @@ jobs:
       STAGE: ${{ github.event.pull_request.number }}
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2
@@ -253,6 +261,10 @@ jobs:
       STAGE: develop
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2
@@ -316,6 +328,10 @@ jobs:
       STAGE: ${{ github.event.pull_request.number }}
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2
@@ -382,6 +398,10 @@ jobs:
       STAGE: ${{ github.event.pull_request.number }}
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2
@@ -448,6 +468,10 @@ jobs:
       STAGE: ${{ github.event.pull_request.number }}
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2
@@ -514,6 +538,10 @@ jobs:
       STAGE: ${{ github.event.pull_request.number }}
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2
@@ -583,6 +611,10 @@ jobs:
       STAGE: ${{ github.event.pull_request.number }}
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2
@@ -651,6 +683,10 @@ jobs:
       STAGE: ${{ github.event.pull_request.number }}
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2
@@ -723,6 +759,10 @@ jobs:
       STAGE: ${{ github.event.pull_request.number }}
       YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4.2.2