Update GitHub Actions workflows.

.github/workflows/license.yml

@@ -40,7 +40,8 @@ jobs:
         with:
           tools: go
           cache-go: false
-      - run: make upstream
+      - run: make prepare_local_workspace
+        continue-on-error: true
       - uses: pulumi/license-check-action@main
         with:
           module-path: provider

.github/workflows/lint.yml

@@ -46,9 +46,9 @@ jobs:
       continue-on-error: true # this fails if there are no go:embed directives
       run: |
         git grep -l 'go:embed' -- provider | xargs sed -i 's/go:embed/ goembed/g'
-    - name: prepare upstream
+    - name: prepare workspace
       continue-on-error: true
-      run: make upstream
+      run: make prepare_local_workspace
     - name: golangci-lint
       uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6
       with:

.github/workflows/master.yml

@@ -133,6 +133,9 @@ jobs:
       - prerequisites
       - build_provider
       - build_sdk
+    permissions:
+      contents: read
+      id-token: write
     secrets: inherit
     with:
       version: ${{ needs.prerequisites.outputs.version }}

.github/workflows/prerelease.yml

@@ -74,6 +74,9 @@ jobs:
       - prerequisites
       - build_provider
       - build_sdk
+    permissions:
+      contents: read
+      id-token: write
     secrets: inherit
     with:
       version: ${{ needs.prerequisites.outputs.version }}

.github/workflows/release.yml

@@ -80,6 +80,9 @@ jobs:
       - prerequisites
       - build_provider
       - build_sdk
+    permissions:
+      contents: read
+      id-token: write
     secrets: inherit
     with:
       version: ${{ needs.prerequisites.outputs.version }}

.github/workflows/run-acceptance-tests.yml

@@ -123,6 +123,9 @@ jobs:
       - prerequisites
       - build_provider
       - build_sdk
+    permissions:
+      contents: read
+      id-token: write
     secrets: inherit
     with:
       version: ${{ needs.prerequisites.outputs.version }}