fix(ci): add missing permissions and protoc dependencies (#9912)

* fix(workflows): add missing permissions and protoc dependencies

Author: gustavovalverde

.github/workflows/book.yml

@@ -44,6 +44,10 @@ jobs:
           mdbook-version: ~0.4
           use-linkcheck: true
           use-mermaid: true
+      - name: Install last version of Protoc
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b #v3.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions-rust-lang/setup-rust-toolchain@ab6845274e2ff01cd4462007e1a9d9df1ab49f42 #v1.14.0
         with:
           toolchain: nightly

.github/workflows/coverage.yml

@@ -41,6 +41,10 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
         with:
           persist-credentials: false
+      - name: Install last version of Protoc
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b #v3.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions-rust-lang/setup-rust-toolchain@ab6845274e2ff01cd4462007e1a9d9df1ab49f42 #v1.14.0
         with:
           toolchain: stable

.github/workflows/release-binaries.yml

@@ -21,6 +21,10 @@ jobs:
   # The image will be named `zebra:<semver>`
   build:
     name: Build Release Docker
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
     uses: ./.github/workflows/zfnd-build-docker-image.yml
     with:
       dockerfile_path: ./docker/Dockerfile

.github/workflows/zfnd-ci-integration-tests-gcp.yml

@@ -105,7 +105,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
 
 env:
   CARGO_TERM_COLOR: always
@@ -129,7 +128,9 @@ jobs:
     # Skip PRs from external repositories, let them pass, and then GitHub's Merge Queue will check them
     if: ${{ (!startsWith(github.event_name, 'pull') || !github.event.pull_request.head.repo.fork) && (github.event_name != 'pull_request' || github.event.label.name == 'run-stateful-tests') }}
     permissions:
+      contents: read
       id-token: write
+      pull-requests: write
       statuses: write
     uses: ./.github/workflows/zfnd-build-docker-image.yml
     with:
@@ -155,6 +156,9 @@ jobs:
     name: Check if cached state disks exist for ${{ inputs.network || vars.ZCASH_NETWORK }}
     # Skip PRs from external repositories, let them pass, and then GitHub's Merge Queue will check them
     if: ${{ (!startsWith(github.event_name, 'pull') || !github.event.pull_request.head.repo.fork) && (github.event_name != 'pull_request' || github.event.label.name == 'run-stateful-tests') }}
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-find-cached-disks.yml
     with:
       network: ${{ inputs.network || vars.ZCASH_NETWORK }}
@@ -166,6 +170,9 @@ jobs:
   get-available-disks-testnet:
     name: Check if cached state disks exist for testnet
     if: ${{ (!startsWith(github.event_name, 'pull') || !github.event.pull_request.head.repo.fork) && (github.event_name != 'pull_request' || github.event.label.name == 'run-stateful-tests') }}
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-find-cached-disks.yml
     with:
       network: Testnet
@@ -182,6 +189,9 @@ jobs:
   sync-to-mandatory-checkpoint:
     name: Zebra checkpoint
     needs: [build, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !fromJSON(needs.get-available-disks.outputs.zebra_checkpoint_disk) || github.event.inputs.regenerate-disks == 'true' }}
     concurrency:
@@ -208,6 +218,9 @@ jobs:
   sync-past-mandatory-checkpoint:
     name: Zebra checkpoint update
     needs: [sync-to-mandatory-checkpoint, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (fromJSON(needs.get-available-disks.outputs.zebra_checkpoint_disk) || needs.sync-to-mandatory-checkpoint.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:
@@ -235,6 +248,9 @@ jobs:
   sync-full-mainnet:
     name: Zebra tip
     needs: [build, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ github.event_name == 'schedule' || !fromJSON(needs.get-available-disks.outputs.zebra_tip_disk) || (github.event.inputs.run-full-sync == 'true' && (inputs.network || vars.ZCASH_NETWORK) == 'Mainnet') }}
     concurrency:
@@ -265,6 +281,9 @@ jobs:
   sync-update-mainnet:
     name: Zebra tip update
     needs: [sync-full-mainnet, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (fromJSON(needs.get-available-disks.outputs.zebra_tip_disk) || needs.sync-full-mainnet.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:
@@ -294,6 +313,9 @@ jobs:
   generate-checkpoints-mainnet:
     name: Generate checkpoints mainnet
     needs: [sync-full-mainnet, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (fromJSON(needs.get-available-disks.outputs.zebra_tip_disk) || needs.sync-full-mainnet.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:
@@ -325,6 +347,9 @@ jobs:
   sync-full-testnet:
     name: Zebra tip on testnet
     needs: [build, get-available-disks-testnet]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !fromJSON(needs.get-available-disks-testnet.outputs.zebra_tip_disk) || (github.event.inputs.run-full-sync == 'true' && (inputs.network || vars.ZCASH_NETWORK) == 'Testnet') }}
     concurrency:
@@ -358,6 +383,9 @@ jobs:
   generate-checkpoints-testnet:
     name: Generate checkpoints testnet
     needs: [sync-full-testnet, get-available-disks-testnet]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (fromJSON(needs.get-available-disks-testnet.outputs.zebra_tip_disk) || needs.sync-full-testnet.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:
@@ -387,6 +415,9 @@ jobs:
   lwd-sync-full:
     name: lightwalletd tip
     needs: [sync-full-mainnet, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     # Currently the lightwalletd tests only work on Mainnet
     if: ${{ !cancelled() && !failure() && (inputs.network || vars.ZCASH_NETWORK) == 'Mainnet' && (fromJSON(needs.get-available-disks.outputs.zebra_tip_disk) || needs.sync-full-mainnet.result == 'success') && (github.event_name == 'schedule' || !fromJSON(needs.get-available-disks.outputs.lwd_tip_disk) || github.event.inputs.run-lwd-sync == 'true' ) }}
@@ -417,6 +448,9 @@ jobs:
   lwd-sync-update:
     name: lightwalletd tip update
     needs: [lwd-sync-full, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (inputs.network || vars.ZCASH_NETWORK) == 'Mainnet' && (fromJSON(needs.get-available-disks.outputs.lwd_tip_disk) || needs.lwd-sync-full.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:
@@ -444,6 +478,9 @@ jobs:
   lwd-rpc-test:
     name: Zebra tip JSON-RPC
     needs: [sync-full-mainnet, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (inputs.network || vars.ZCASH_NETWORK) == 'Mainnet' && (fromJSON(needs.get-available-disks.outputs.zebra_tip_disk) || needs.sync-full-mainnet.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:
@@ -465,6 +502,9 @@ jobs:
   lwd-rpc-send-tx:
     name: Lightwalletd send transactions
     needs: [lwd-sync-full, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (inputs.network || vars.ZCASH_NETWORK) == 'Mainnet' && (fromJSON(needs.get-available-disks.outputs.lwd_tip_disk) || needs.lwd-sync-full.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:
@@ -487,6 +527,9 @@ jobs:
   lwd-grpc-wallet:
     name: lightwalletd GRPC tests
     needs: [lwd-sync-full, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (inputs.network || vars.ZCASH_NETWORK) == 'Mainnet' && (fromJSON(needs.get-available-disks.outputs.lwd_tip_disk) || needs.lwd-sync-full.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:
@@ -513,6 +556,9 @@ jobs:
   rpc-get-block-template:
     name: get block template
     needs: [sync-full-mainnet, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (fromJSON(needs.get-available-disks.outputs.zebra_tip_disk) || needs.sync-full-mainnet.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:
@@ -535,6 +581,9 @@ jobs:
   rpc-submit-block:
     name: submit block
     needs: [sync-full-mainnet, get-available-disks]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-deploy-integration-tests-gcp.yml
     if: ${{ !cancelled() && !failure() && (fromJSON(needs.get-available-disks.outputs.zebra_tip_disk) || needs.sync-full-mainnet.result == 'success') && github.event.inputs.regenerate-disks != 'true' && github.event.inputs.run-full-sync != 'true' && github.event.inputs.run-lwd-sync != 'true' }}
     with:

.github/workflows/zfnd-deploy-nodes-gcp.yml

@@ -143,6 +143,9 @@ jobs:
   # PRs from forked repositories are skipped.
   get-disk-name:
     name: Get disk name
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/zfnd-find-cached-disks.yml
     if: ${{ !(github.event.pull_request.head.repo.fork) && (github.event_name != 'workflow_dispatch' || inputs.need_cached_disk) }}
     with:
@@ -156,6 +159,10 @@ jobs:
   # The image will be commonly named `zebrad:<short-hash | github-ref | semver>`
   build:
     name: Build CD Docker
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
     uses: ./.github/workflows/zfnd-build-docker-image.yml
     if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
     with: