ci: Add write permission to security events when building ig.

[eiffel-fl]

This is needed by CodeQL to be able to report events.

Signed-off-by: Francis Laniel flaniel@linux.microsoft.com
Fixes: f04d95b ("ci: Add CWE checks for ig.")
[1]: github/codeql#8843 (comment)

[mauriciovasquezbernal]

Otherwise, it explodes when run on main.

Can you describe what's exploding in this case? Issue on our end? Limitation of CodeQL? Anything else?

[eiffel-fl]

Otherwise, it explodes when run on main.

Can you describe what's exploding in this case? Issue on our end? Limitation of CodeQL? Anything else?

I updated the commit message with the corresponding documentation.

[mauriciovasquezbernal]

I can't see how https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-pull-requests explains the issue, above that it says it can also run on push -> https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push

The failing run says Resource not accessible by integration, according to github/codeql#8843 (comment) it could be it's missing security-events: write.

I see those permissions are set in

inspektor-gadget/.github/workflows/inspektor-gadget.yml

Lines 254 to 255 in 0564754

	permissions:
	security-events: write

but that's part of the btfgen job, should it be moved to the build-ig one?

I can also see the CodeQl checks worked fine for kubectl-gadget (https://github.com/inspektor-gadget/inspektor-gadget/actions/runs/7272757833/job/19815436935), hence I think there is something off with the ig case.

[eiffel-fl]

I can't see how https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-pull-requests explains the issue, above that it says it can also run on push -> https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push

The failing run says Resource not accessible by integration, according to github/codeql#8843 (comment) it could be it's missing security-events: write.

I see those permissions are set in

inspektor-gadget/.github/workflows/inspektor-gadget.yml

Lines 254 to 255 in 0564754

	permissions:
	security-events: write

but that's part of the btfgen job, should it be moved to the build-ig one?

I can also see the CodeQl checks worked fine for kubectl-gadget (https://github.com/inspektor-gadget/inspektor-gadget/actions/runs/7272757833/job/19815436935), hence I think there is something off with the ig case.

Indeed, I forgot to add this permission to build-ig in the previous PR while I did it for the other checks, I guess this is what happens when you work again on PR opened since ages.
Anyway, it should fix the issue, but I do not understand why it did not break inside the previous PR.

[mauriciovasquezbernal]

LGTM once the permissions are removed from the btfgen job.

[eiffel-fl]

Thank you for the review!