Bug: Fix CI permissions

[rdimitrov]

The default permissions of the GITHUB_TOKEN during GitHub Actions were changed this week for the whole organization.

In our case, Goreleaser depends on having write permissions if we want to publish releases to GitHub, so this affects our CI. To solve that we have to elevate the token permissions for the CI workflow.

Reference:

Invalid workflow file: .github/workflows/ci.yml#L12
The workflow is not valid. .github/workflows/ci.yml (Line: 12, Col: 3): Error calling workflow 'theupdateframework/go-tuf/.github/workflows/release.yml@c803c81'. The nested job 'release' is requesting 'contents: write', but is only allowed 'contents: read'.

[trishankatdatadog]

In our case, Goreleaser depends on having write permissions if we want to publish releases to GitHub, so this affects our CI. To solve that we have to elevate the token permissions for the CI workflow.

Is it possible to override per repo?

[joshuagl]

You can just elevate permissions for the job that makes the release, i.e. https://github.com/theupdateframework/python-tuf/blob/7c756efe0084f20eb9de88665e9b299eb8a3d6b2/.github/workflows/cd.yml#L49