Merge branch 'maint'

Author: kikofernandez

.github/workflows/openvex-sync.yml

@@ -71,6 +71,11 @@ jobs:
           # required
           app-id: ${{ vars.ERLANG_BOT_APP_ID }}
           private-key: ${{ secrets.ERLANG_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-security-events: read
+          permission-actions: write
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Authenticate gh
         env:

.github/workflows/reusable-vendor-vulnerability-scanner.yml

@@ -154,6 +154,10 @@ jobs:
         with:
           app-id: ${{ secrets.ERLANG_VENDOR_SCANNER_APP_ID }}
           private-key: ${{ secrets.ERLANG_VENDOR_SCANNER_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-issues: write
+          permission-content: read
+          permission-actions: write
 
       # PRs comming from a fork can use their own GH_TOKEN instead.
       # this is for security reasons that forked PRs cannot work with Github App tokens

.github/workflows/sigstore-updater.yml

@@ -151,6 +151,10 @@ jobs:
         with:
           app-id: ${{ vars.ERLANG_BOT_APP_ID }}
           private-key: ${{ secrets.ERLANG_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-issues: write
+          permission-content: read
+          permission-actions: write
       - name: Authenticate gh
         if: steps.changed.outputs.found == 'true'
         env: