From 0499d9c1c4177503c4a3d8d6bffd5d44e5edd430 Mon Sep 17 00:00:00 2001
From: Mohammed Al Sahaf <msaa1990@gmail.com>
Date: Mon, 5 Sep 2022 23:57:27 +0300
Subject: ci: add `id-token` permission and update the signing command (#5016)

---
 .github/workflows/release.yml | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d67f875..8ab9488 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,12 @@ jobs:
           GO_SEMVER: '~1.19.0'
 
     runs-on: ${{ matrix.os }}
+    # https://github.com/sigstore/cosign/issues/1258#issuecomment-1002251233
+    # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
+    permissions:
+      id-token: write
+      # https://docs.github.com/en/rest/overview/permissions-required-for-github-apps#permission-on-contents
+      contents: read
 
     steps:
     - name: Install Go
-- 
cgit v1.2.3