Added support for permissions props

packages/cdkactions/src/job.ts

@@ -1,5 +1,5 @@
 import { Construct } from 'constructs';
-import { StringMap, RunProps, DefaultsProps } from './types';
+import { StringMap, RunProps, DefaultsProps, PermissionsProps } from './types';
 import { renameKeys } from './utils';
 import { Workflow } from './workflow';
 
@@ -193,6 +193,12 @@ export interface JobProps {
    * Additional Docker services provided to the job.
    */
   readonly services?: { [key: string]: DockerProps };
+
+  /**
+   * Modifies the default permissions granted to the GITHUB_TOKEN
+   * https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_idpermissions
+   */
+  readonly permissions?: PermissionsProps;
 }
 
 /**

packages/cdkactions/src/types.ts

@@ -35,3 +35,24 @@ export interface DefaultsProps {
    */
   readonly [key: string]: any;
 }
+
+/**
+ * Permissions to apply to all scopes
+ */
+export type PermissionAccessAll = 'read-all' | 'write-all';
+
+/**
+ * Permissions to apply to individual scopes
+ */
+export type PermissionAccess = 'read' | 'write' | 'none';
+
+/**
+ * All available permission scopes
+ */
+export type PermissionScope = 'actions' | 'checks' | 'contents' | 'deployments' | 'id-token' | 'issues' | 'discussions' | 'packages' | 'pages' | 'pull-requests' | 'repository-projects' | 'security-events' | 'statuses';
+
+/**
+ * Configuration for permissions
+ */
+export type PermissionsProps = PermissionAccessAll | Partial<Record<PermissionScope, PermissionAccess>>;
+

packages/cdkactions/src/workflow.ts

@@ -1,6 +1,6 @@
 import { Construct, Node } from 'constructs';
 import { Job } from './job';
-import { StringMap, DefaultsProps } from './types';
+import { StringMap, DefaultsProps, PermissionsProps } from './types';
 import { renameKeys, camelToSnake } from './utils';
 
 /**
@@ -347,6 +347,12 @@ export interface WorkflowProps {
    */
   readonly on: Events | Array<Events> | EventMap | ScheduleEvent | WorkflowRunEvent;
 
+  /**
+   * Modifies the default permissions granted to the GITHUB_TOKEN
+   * https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#permissions
+   */
+  readonly permissions?: PermissionsProps;
+
   /**
    * A map of environment variables to provide to the job.
    */

packages/cdkactions/test/__snapshots__/job.test.ts.snap

@@ -3,6 +3,10 @@
 exports[`toGHAction 1`] = `
 Object {
   "continue-on-error": true,
+  "permissions": Object {
+    "contents": "write",
+    "id-token": "write",
+  },
   "runs-on": "ubuntu-latest",
   "steps": Array [
     Object {

packages/cdkactions/test/__snapshots__/workflow.test.ts.snap

@@ -27,5 +27,9 @@ Object {
       ],
     },
   },
+  "permissions": Object {
+    "contents": "write",
+    "id-token": "write",
+  },
 }
 `;

packages/cdkactions/test/job.test.ts

@@ -9,6 +9,10 @@ test('toGHAction', () => {
       fastFail: true,
       maxParallel: 11,
     },
+    permissions: {
+      'id-token': 'write',
+      'contents': 'write',
+    },
     steps: [{
       name: 'step',
       continueOnError: false,

packages/cdkactions/test/workflow.test.ts

@@ -18,6 +18,10 @@ test('toGHAction', () => {
         workingDirectory: '~/',
       },
     },
+    permissions: {
+      'id-token': 'write',
+      'contents': 'write',
+    },
   });
   expect(workflow.toGHAction()).toMatchSnapshot();
 });