feat: add attestations: write permission for image provenance attestation - #381
Conversation
…tion Required by the attest-build-provenance step added to the shared incluster-comp-pr-merged.yaml workflow in kubescape/workflows. Signed-off-by: Varadraj75 <agrawalvaradraj2007@gmail.com>
|
Warning Review limit reached
More reviews will be available in 52 minutes and 8 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe GitHub Actions workflow file for merged PRs is updated with a single permission addition: ChangesWorkflow Permissions Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds GitHub Actions permissions to allow the “pr-merged” workflow (reusable workflow invocation) to write artifact attestations when a PR is merged.
Changes:
- Grant
attestations: writepermission to the workflow job invokingkubescape/workflowsreusable workflow.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| packages: write | ||
| contents: write | ||
| pull-requests: read | ||
| attestations: write | ||
| uses: kubescape/workflows/.github/workflows/incluster-comp-pr-merged.yaml@main |
There was a problem hiding this comment.
Added an inline comment to make the purpose clear.
| packages: write | ||
| contents: write | ||
| pull-requests: read | ||
| attestations: write |
There was a problem hiding this comment.
id-token: write is already present at line 34 in the same permissions block , it was there before this change for keyless cosign signing.
Signed-off-by: Varadraj75 <agrawalvaradraj2007@gmail.com>
Overview
Adds
attestations: writeto thepr-mergedjob permissions so theactions/attest-build-provenancestep added to the sharedincluster-comp-pr-merged.yamlworkflow in kubescape/workflows can push attestations to the GitHub attestations API. Without this the attest step fails with a 403 on release runs.Additional Information
This is part of a series of PRs adding SLSA provenance attestation across kubescape repos, tracked in kubescape/kubescape#1033. Requires kubescape/workflows#89 to be merged first.
Related issues/PRs
Checklist before requesting a review
Summary by CodeRabbit