Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: notes for matrix and required permissions #469

Merged
merged 1 commit into from
May 28, 2024
Merged

docs: notes for matrix and required permissions #469

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,27 @@ use the `artifact-name` parameter:
artifact-name: sbom.spdx
```

> [!IMPORTANT]
> If using this action within a **matrix build**, you must specify a unique `artifact-name`
> based on matrix parameters or the artifact upload will fail due to duplicate names. See
> an [example here](.github/workflows/test.yml#L36).

## Permissions

This action needs the following permissions, depending on how it is being used:

```
contents: write # for sbom-action artifact uploads
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm a bit confused by these YAML comments. It might help if there was a list of use case to required permissions. I suspect there are some permissions always needed, and some only needed for certain use cases.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm open to suggestions how to make this more clear. There are 2 main things this does: create an SBOM and upload it as a workflow artifact (the first permission) and attach release assets (the second permission), a user only needs to set the permission for the thing they're doing, which the comments indicate.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How does actions: read grant permissions to attach things to the release assets? Does it not need some write permissions for that?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated -- is this more clear, @willmurphyscode ?

```

If attaching release assets, the `actions: read` permission is also required.
This may be implicit for public repositories, but is likely to be necessary for
private repositories.

```
actions: read # to find workflow artifacts when attaching release assets
```

## Configuration

### anchore/sbom-action
Expand Down
Loading