Add in needed GHA token permissions

Run-GHA: true Signed-off-by: Margaret Lawson <[email protected]>
daos-stack · Dec 5, 2024 · 4aa9ffb · 4aa9ffb
1 parent 6c9950f
commit 4aa9ffb
Showing 1 changed file with 12 additions and 2 deletions.
diff --git a/.github/workflows/gcp-rpm-build-and-test.yml b/.github/workflows/gcp-rpm-build-and-test.yml
@@ -54,6 +54,10 @@ jobs:
     # instead we assume success at the beginning and then let any axis that fails remove the
     # lastSuccessfulBuild link if it fails
     name: Create lastBuild and lastSuccessfulBuild symlinks
+    permissions:
+      statuses: write
+      contents: read
+      id-token: write
     runs-on: [self-hosted, gcp]
     steps:
       - name: Authenticate to GCP
@@ -62,9 +66,11 @@ jobs:
         with:
           project_id: ${{ env.PROJECT_ID }}
           workload_identity_provider: ${{ env.WIP_PROVIDER }}
+      - name: "Set up Cloud SDK"
+        uses: "google-github-actions/setup-gcloud@v2"
       - name: Set up GCSFUSE
         run: |
-              fusermount -u ${GCS_BUCKET_MOUNT_PT} || true
+              sudo fusermount -u ${GCS_BUCKET_MOUNT_PT} && sudo rm -fr /tmp/gcp_artifacts || true
               mkdir -p "${GCS_BUCKET_MOUNT_PT}"
               gcsfuse --implicit-dirs "${GCS_BUCKET}" "${GCS_BUCKET_MOUNT_PT}"
       - name: Create lastBuild and lastSuccessfulBuild symlinks
@@ -104,6 +110,8 @@ jobs:
     name: Build RPM
     permissions:
       statuses: write
+      contents: read
+      id-token: write
     runs-on: [self-hosted, gcp]
     needs: [Create-symlinks, Calc-rpm-build-matrix]
     if: needs.Create-symlinks.result == 'success' &&
@@ -233,9 +241,11 @@ jobs:
         with:
           project_id: ${{ env.PROJECT_ID }}
           workload_identity_provider: ${{ env.WIP_PROVIDER }}
+      - name: "Set up Cloud SDK"
+        uses: "google-github-actions/setup-gcloud@v2"
       - name: Set up GCSFUSE
         run: |
-              fusermount -u ${GCS_BUCKET_MOUNT_PT} || true
+              sudo fusermount -u ${GCS_BUCKET_MOUNT_PT} && sudo rm -fr /tmp/gcp_artifacts || true
               mkdir -p "${GCS_BUCKET_MOUNT_PT}"
               gcsfuse --implicit-dirs "${GCS_BUCKET}" "${GCS_BUCKET_MOUNT_PT}"
       - name: Remove lastSuccessfulBuild link and exit failure