add github actions attestations scope to write-all (#62)

boostsecurityio · May 7, 2024 · e0d6048 · e0d6048
1 parent cb6ce21
commit e0d6048
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/models/github_actions.go b/models/github_actions.go
@@ -9,6 +9,7 @@ import (
 const (
 	ScopeMetadata           = "metadata"
 	ScopeActions            = "actions"
+	ScopeAttestations       = "attestations"
 	ScopeChecks             = "checks"
 	ScopeContents           = "contents"
 	ScopeDeployments        = "deployments"
@@ -30,6 +31,7 @@ const (
 var AllScopes = []string{
 	ScopeMetadata,
 	ScopeActions,
+	ScopeAttestations,
 	ScopeChecks,
 	ScopeContents,
 	ScopeDeployments,

diff --git a/models/github_actions_test.go b/models/github_actions_test.go
@@ -439,6 +439,7 @@ jobs:
 	// write-all is normalized to all scopes
 	assert.Contains(t, workflow.Permissions, GithubActionsPermission{Scope: "metadata", Permission: "write"})
 	assert.Contains(t, workflow.Permissions, GithubActionsPermission{Scope: "contents", Permission: "write"})
+	assert.Contains(t, workflow.Permissions, GithubActionsPermission{Scope: "attestations", Permission: "write"})
 
 	assert.Equal(t, "build", workflow.Jobs[0].Outputs[0].Name)
 	assert.Equal(t, "${{ steps.checkout.outputs.build }}", workflow.Jobs[0].Outputs[0].Value)