Fix workflow permissions for publishing security assets to releases

Kong · Apr 26, 2024 · 1e4232e · 1e4232e
1 parent 05dc4d0
commit 1e4232e
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -31,8 +31,8 @@ jobs:
   check:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       packages: write 
+      contents: write # publish sbom to GH releases/tag assets
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
@@ -46,6 +46,7 @@ jobs:
           dir: .
           upload-sbom-release-assets: true
 
+
   # Build docker images
   build-images:
     runs-on: ubuntu-latest
@@ -108,7 +109,7 @@ jobs:
   scan-images:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write # For publishing assets to releases
       packages: write
     needs: [check, build-images]
     if: >