fix(ci): permissions to publish npm provenance (#351)

Kong · May 16, 2024 · cfb34a7 · cfb34a7
1 parent 36d0de1
commit cfb34a7
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -63,6 +63,11 @@ jobs:
 
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write # For using token to sign images
+      actions: read # For getting workflow run info to build provenance
+      packages: write # Required for publishing provenance. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues
     if: ${{ github.ref_type == 'tag' && github.repository_owner == 'Kong' }}
     steps:
       # checkout tag