Fix permissions for poutine_analysis job (#2246)

* Fix permissions for poutine_analysis job

Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
* supplychain job permissions in commit-to-main

Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
---------

Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>

diff --git a/.github/workflows/commit-to-main.yml b/.github/workflows/commit-to-main.yml
index 31db38292a9bcaa80a3b86ccef078a5c2158bbf0..65e494d8289f30a7c5531319bf0e10e872198a1f 100644 (file)
--- a/.github/workflows/commit-to-main.yml
+++ b/.github/workflows/commit-to-main.yml
@@ -22,6 +22,7 @@ jobs:
     permissions:
       id-token: write
       security-events: write
+      contents: read
 
   basic-downstream:
     uses: ./.github/workflows/downstream-basic.yml

diff --git a/.github/workflows/supplychain.yml b/.github/workflows/supplychain.yml
index 3d5f2014fbc56de78f76cfcc90c08b23f85faa49..07d924fffa41f6740952b98869251e2190374ca8 100644 (file)
--- a/.github/workflows/supplychain.yml
+++ b/.github/workflows/supplychain.yml
@@ -1,6 +1,7 @@
 name: Scorecard supply-chain security
 
-permissions: {}
+permissions:
+  contents: read
 
 on:
   # For Branch-Protection check. Only the default branch is supported. See