Grc 243 migrate static aws credentials

.github/workflows/build-linux-binaries.yml

@@ -13,6 +13,9 @@ on:
 jobs:
   build-x86_64-binaries-tarball:
     runs-on: ubuntu-20.04
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
@@ -72,6 +75,9 @@ jobs:
 
   build-arm64-binaries-tarball:
     runs-on: custom-arm64-focal
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/build-macos-release.yml

@@ -19,6 +19,9 @@ jobs:
   build-mac:
     # The type of runner that the job will run on
     runs-on: macos-12
+    permissions:
+      id-token: write
+      contents: read
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:

.github/workflows/build-public-ami.yml

@@ -18,6 +18,9 @@ jobs:
   build-public-ami-and-upload:
     runs-on: ubuntu-22.04
     timeout-minutes: 45
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/build-ubuntu-amd64-release.yml

@@ -13,6 +13,9 @@ on:
 jobs:
   build-jammy-amd64-package:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
@@ -70,6 +73,9 @@ jobs:
 
   build-focal-amd64-package:
     runs-on: ubuntu-20.04
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/build-ubuntu-arm64-release.yml

@@ -13,6 +13,9 @@ on:
 jobs:
   build-jammy-arm64-package:
     runs-on: custom-arm64-jammy
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
@@ -70,6 +73,9 @@ jobs:
 
   build-focal-arm64-package:
     runs-on: custom-arm64-focal
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/build-win-release.yml

@@ -19,6 +19,10 @@ jobs:
   build-win:
     # The type of runner that the job will run on
     runs-on: windows-2019
+    permissions:
+      id-token: write
+      contents: read
+
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it