Merge pull request #858 from ianlewis/blog-permissions

fix: Permissions in blog snippet
slsa-framework · May 12, 2023 · ea9659b · ea9659b
2 parents f5cd69d + 7c7e73f
commit ea9659b
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/...s/2023-05-11-bringing-improved-supply-chain-security-to-the-nodejs-ecosystem.md b/...s/2023-05-11-bringing-improved-supply-chain-security-to-the-nodejs-ecosystem.md
@@ -86,9 +86,9 @@ seamlessly.
 jobs:
   build:
     permissions:
-      id-token: write # for creating OIDC tokens for signing.
-      contents: write # for uploading to releases.
-      packages: write # for uploading attestations.
+      id-token: write # For signing
+      contents: read  # For repo checkout.
+      actions: read   # For getting workflow run info.
     if: startsWith(github.ref, 'refs/tags/')
     uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v1.6.0
     with: