Chore: [AEA-6527] - fix permissions so can publish packages

.github/workflows/pull_request.yml

@@ -49,9 +49,9 @@ jobs:
     needs: get_config_values
     uses: ./.github/workflows/tag-release-devcontainer.yml
     permissions:
-      packages: read
       id-token: write
       contents: write
+      packages: write
     with:
       dry_run: true
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

.github/workflows/release.yml

@@ -32,6 +32,7 @@ jobs:
     permissions:
       id-token: write
       contents: write
+      packages: write
     with:
       dry_run: false
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

.github/workflows/tag-release-devcontainer.yml

@@ -86,6 +86,7 @@ jobs:
         permissions:
             id-token: "write"
             contents: "write"
+            packages: "write"
         runs-on: ubuntu-22.04
         container:
             image: ${{ inputs.pinned_image }}

README.md

@@ -174,6 +174,10 @@ jobs:
   tag_release:
     uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f5c8313a10855d0cc911db6a9cd666494c00045a
     needs: [get_config_values]
+    permissions:
+      id-token: write
+      contents: write
+      packages: write
     with:
       tag_format: "v\\${version}-beta"
       dry_run: true

zizmor.yml

@@ -14,4 +14,4 @@ rules:
   artipacked:
     ignore:
       # this is ignored as its based on using an input to the workflow
-      - tag-release-devcontainer.yml:114:15
+      - tag-release-devcontainer.yml:115:15