plugin-barman-cloud/.github/workflows/release-publish.yml
Jonathan Gonzalez V. 9640fde14e
ci(security): reduce workflows permissions (#355)
Set by default the permission to read-all in all the workflows and add
the proper permissions for the following workflows:

* CI
* release-please
* Release Publish Artifacts

closes #352

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
2025-05-29 16:08:30 +02:00

39 lines
1.0 KiB
YAML

name: Release Publish Artifacts
on:
release:
types: [published]
permissions: read-all
jobs:
release-publish-artifacts:
runs-on: ubuntu-latest
permissions:
packages: write
contents: write
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Install QEMU static binaries
uses: docker/setup-qemu-action@v3
- name: Install Task
uses: arduino/setup-task@v2
- name: Install Dagger
env:
# renovate: datasource=github-tags depName=dagger/dagger versioning=semver
DAGGER_VERSION: 0.18.5
run: |
curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
- name: Create image and manifest
env:
REGISTRY_USER: ${{ github.actor }}
REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
run: |
task publish
task manifest
- name: Attach manifest to release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
task upload-manifest-to-release