Merge pull request #5828 from sysown/feature/ci-codecov-tap-all-groups-callers

ci(coverage): grant write-all on TAP-group callers for Codecov OIDC

Author: renecannao

.github/workflows/CI-legacy-clickhouse-g1.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-legacy-clickhouse-g1.yml@GH-Actions
     secrets: inherit
     with:

.github/workflows/CI-legacy-g1.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-legacy-g1.yml@GH-Actions
     secrets: inherit
     with:

.github/workflows/CI-legacy-g3.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-legacy-g3.yml@GH-Actions
     secrets: inherit
     with:

.github/workflows/CI-legacy-g4.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-legacy-g4.yml@GH-Actions
     secrets: inherit
     with:

.github/workflows/CI-legacy-g5.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-legacy-g5.yml@GH-Actions
     secrets: inherit
     with:

.github/workflows/CI-legacy-g6.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-legacy-g6.yml@GH-Actions
     secrets: inherit
     with:

.github/workflows/CI-legacy-g7.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-legacy-g7.yml@GH-Actions
     secrets: inherit
     with:

.github/workflows/CI-legacy-g8.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-legacy-g8.yml@GH-Actions
     secrets: inherit
     with:

.github/workflows/CI-legacy-g9.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-legacy-g9.yml@GH-Actions
     secrets: inherit
     with:

.github/workflows/CI-mariadb10-galera-g1.yml

@@ -14,6 +14,13 @@ concurrency:
 jobs:
   run:
     if: ${{ github.event.workflow_run && github.event.workflow_run.conclusion == 'success' || ! github.event.workflow_run }}
+    # `write-all` is required for the callee's `use_oidc: true` Codecov
+    # upload step to mint a GitHub OIDC token. Reusable-workflow
+    # permissions are the intersection of caller + callee, so the
+    # caller has to grant id-token:write (and everything else included
+    # in write-all) for the callee's declaration to take effect. The
+    # callee at ci-<group>.yml@GH-Actions also declares write-all.
+    permissions: write-all
     uses: sysown/proxysql/.github/workflows/ci-mariadb10-galera-g1.yml@GH-Actions
     secrets: inherit
     with: