From c5f7668d6384b5d305b4aac2394487402bdcd5dd Mon Sep 17 00:00:00 2001
From: Margaret Lawson <mlawsonca@google.com>
Date: Thu, 5 Dec 2024 22:45:57 +0000
Subject: [PATCH] Add in needed GHA token permissions

Run-GHA: true
Signed-off-by: Margaret Lawson <mlawsonca@google.com>
---
 .github/workflows/gcp-rpm-build-and-test.yml | 24 ++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/gcp-rpm-build-and-test.yml b/.github/workflows/gcp-rpm-build-and-test.yml
index fd0b810..2e1cfbf 100644
--- a/.github/workflows/gcp-rpm-build-and-test.yml
+++ b/.github/workflows/gcp-rpm-build-and-test.yml
@@ -54,19 +54,31 @@ jobs:
     # instead we assume success at the beginning and then let any axis that fails remove the
     # lastSuccessfulBuild link if it fails
     name: Create lastBuild and lastSuccessfulBuild symlinks
+    permissions:
+      statuses: write
+      contents: read
+      id-token: write
     runs-on: [self-hosted, gcp]
     steps:
+      # we are required to checkout the code to have auth save the token we need for GCSFUSE
+      # per https://github.com/google-github-actions/auth#inputs-miscellaneous
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
       - name: Authenticate to GCP
         id: gcp-authentication
         uses: 'google-github-actions/auth@v2'
         with:
           project_id: ${{ env.PROJECT_ID }}
           workload_identity_provider: ${{ env.WIP_PROVIDER }}
+      - name: "Set up Cloud SDK"
+        uses: "google-github-actions/setup-gcloud@v2"
       - name: Set up GCSFUSE
         run: |
-              fusermount -u ${GCS_BUCKET_MOUNT_PT} || true
+              sudo fusermount -u ${GCS_BUCKET_MOUNT_PT} && sudo rm -fr /tmp/gcp_artifacts || true
               mkdir -p "${GCS_BUCKET_MOUNT_PT}"
-              gcsfuse --implicit-dirs "${GCS_BUCKET}" "${GCS_BUCKET_MOUNT_PT}"
+              sudo -u ext_mlawsonca_google_com gcsfuse --implicit-dirs "${GCS_BUCKET}" "${GCS_BUCKET_MOUNT_PT}"
       - name: Create lastBuild and lastSuccessfulBuild symlinks
         run: mkdir -p ${REPO_PATH};
                rm -f ${REPO_PATH}last{,Successful}Build;
@@ -104,6 +116,8 @@ jobs:
     name: Build RPM
     permissions:
       statuses: write
+      contents: read
+      id-token: write
     runs-on: [self-hosted, gcp]
     needs: [Create-symlinks, Calc-rpm-build-matrix]
     if: needs.Create-symlinks.result == 'success' &&
@@ -233,11 +247,13 @@ jobs:
         with:
           project_id: ${{ env.PROJECT_ID }}
           workload_identity_provider: ${{ env.WIP_PROVIDER }}
+      - name: "Set up Cloud SDK"
+        uses: "google-github-actions/setup-gcloud@v2"
       - name: Set up GCSFUSE
         run: |
-              fusermount -u ${GCS_BUCKET_MOUNT_PT} || true
+              sudo fusermount -u ${GCS_BUCKET_MOUNT_PT} && sudo rm -fr /tmp/gcp_artifacts || true
               mkdir -p "${GCS_BUCKET_MOUNT_PT}"
-              gcsfuse --implicit-dirs "${GCS_BUCKET}" "${GCS_BUCKET_MOUNT_PT}"
+              sudo -u ext_mlawsonca_google_com gcsfuse --implicit-dirs "${GCS_BUCKET}" "${GCS_BUCKET_MOUNT_PT}"
       - name: Remove lastSuccessfulBuild link and exit failure
         if: steps.test-repo.outcome != 'success'
         run: rm -f ${REPO_PATH}lastSuccessfulBuild;