Skip to content

Commit a311dc8

Browse files
committed
fix(ci): fix PR validation workflow permissions and config
Move permissions to job level with read-all at workflow level, remove --collectors aiconfig flag, and fix project name to chainloop. Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
1 parent fc85a31 commit a311dc8

1 file changed

Lines changed: 7 additions & 6 deletions

File tree

.github/workflows/pr_validation.yaml

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,20 +13,21 @@ on:
1313
branches:
1414
- main
1515

16-
permissions:
17-
contents: read
18-
id-token: write # Required for GitHub keyless attestation via OIDC
19-
pull-requests: read # Required to fetch PR reviews
16+
permissions: read-all
2017

2118
jobs:
2219
# Create and push a Chainloop attestation for this PR event
2320
attestation:
2421
if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'github-actions[bot]' && github.event.pull_request.draft == false }}
2522
name: Perform PR Validation
2623
runs-on: ubuntu-latest
24+
permissions:
25+
contents: read
26+
id-token: write
27+
pull-requests: read
2728
env:
2829
CHAINLOOP_WORKFLOW_NAME: pr-validation
29-
CHAINLOOP_PROJECT_NAME: chainloop-platform
30+
CHAINLOOP_PROJECT_NAME: chainloop
3031
steps:
3132
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3233

@@ -38,7 +39,7 @@ jobs:
3839
# Initialize a new attestation for this PR event
3940
- name: Initialize Attestation
4041
run: |
41-
chainloop attestation init --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME} --collectors aiconfig
42+
chainloop attestation init --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME}
4243
env:
4344
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4445

0 commit comments

Comments
 (0)