fix workflow

Author: anthony-nhs

.gitallowed

@@ -4,3 +4,4 @@ token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"?
 github-token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"?
 token: ?"?\$\{\{\s*secrets\.DEPENDABOT_TOKEN\s*\}\}"?
 \.gitallowed
+id-token: "write"

.github/workflows/ci.yml

@@ -6,12 +6,16 @@ on:
 permissions: {}
 jobs:
     get_config_values:
-        uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
+        permissions:
+            attestations: "read"
+            contents: "read"
+            packages: "read"
         with:
             verify_published_from_main_image: false
 
     quality_checks:
-        uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
         needs: [get_config_values]
         with:
             pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
@@ -20,7 +24,7 @@ jobs:
 
     tag_release:
         needs: [get_config_values]
-        uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
         permissions:
             id-token: "write"
             contents: "write"

.github/workflows/pull_request.yml

@@ -6,30 +6,34 @@ on:
 permissions: {}
 jobs:
     get_config_values:
-        uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
+        permissions:
+            attestations: "read"
+            contents: "read"
+            packages: "read"
         with:
             verify_published_from_main_image: false
 
     dependabot-auto-approve-and-merge:
-        uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
         secrets:
             AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
             AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
 
     quality_checks:
-        uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
         needs: [get_config_values]
         with:
             pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
         secrets:
             SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
     pr_title_format_check:
-        uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
 
     tag_release:
         needs: [get_config_values]
-        uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
         permissions:
             id-token: "write"
             contents: "write"

.github/workflows/release.yml

@@ -7,12 +7,16 @@ on:
 permissions: {}
 jobs:
     get_config_values:
-        uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
+        permissions:
+            attestations: "read"
+            contents: "read"
+            packages: "read"
         with:
             verify_published_from_main_image: false
 
     quality_checks:
-        uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
         needs: [get_config_values]
         with:
             pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
@@ -21,7 +25,7 @@ jobs:
 
     tag_release:
         needs: [get_config_values]
-        uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
+        uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@68c2dea999875055ecbfdf055d8391e6e8b8ce2f
         permissions:
             id-token: "write"
             contents: "write"