Merge pull request #396 from crazy-max/release-fix-perms

allow release workflows to create GitHub releases

Author: crazy-max

.github/workflows/build-agent.yml

@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: agent

.github/workflows/build-buildx.yml

@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: buildx

.github/workflows/build-compose.yml

@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: compose

.github/workflows/build-containerd.yml

@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: containerd

.github/workflows/build-credential-helpers.yml

@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: credential-helpers

.github/workflows/build-docker-cli.yml

@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: docker-cli

.github/workflows/build-docker-engine.yml

@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: docker-engine

.github/workflows/build-model.yml

@@ -32,5 +32,7 @@ on:
 jobs:
   run:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     with:
       name: model

.github/workflows/nightly.yml

@@ -19,6 +19,8 @@ jobs:
 
   build:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
     needs:
       - pkgs
     strategy:

.github/workflows/release-agent.yml

@@ -44,6 +44,8 @@ on:
 jobs:
   release:
     uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
     with:
       name: agent
       release: ${{ inputs.release }}