Commit 93d84cc
committed
ci(deploy): document why id-token: write is kept at job level
Annotate the permissions blocks with the reason the job needs
id-token: write (actions/attest-build-provenance obtains a Sigstore
OIDC token). The build jobs also note that the narrower-blast-radius
refactor — splitting attestation into a dedicated job — was
considered and rejected as disproportionate.1 parent c9a93de commit 93d84cc
1 file changed
Lines changed: 11 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
66 | 66 | | |
67 | 67 | | |
68 | 68 | | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
69 | 72 | | |
70 | 73 | | |
71 | 74 | | |
| |||
113 | 116 | | |
114 | 117 | | |
115 | 118 | | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
116 | 122 | | |
117 | 123 | | |
118 | 124 | | |
| |||
159 | 165 | | |
160 | 166 | | |
161 | 167 | | |
| 168 | + | |
| 169 | + | |
| 170 | + | |
162 | 171 | | |
163 | 172 | | |
164 | 173 | | |
| |||
250 | 259 | | |
251 | 260 | | |
252 | 261 | | |
| 262 | + | |
253 | 263 | | |
254 | 264 | | |
255 | 265 | | |
| |||
397 | 407 | | |
398 | 408 | | |
399 | 409 | | |
| 410 | + | |
400 | 411 | | |
401 | 412 | | |
402 | 413 | | |
| |||
0 commit comments