Merge pull request #16264 from miodvallat/backport-16169-to-auth-4.9.x

auth: backport "build-docker-images-tags: Grant enough permissions to sign images" to 4.9.x

Author: rgacogne

.github/workflows/build-docker-images-tags.yml

@@ -11,6 +11,9 @@ on:
 permissions:
   actions: read
   contents: read
+  # This is used to complete the identity challenge
+  # with sigstore/fulcio when running outside of PRs.
+  id-token: write
 
 jobs:
   prepare:

.github/workflows/docker.yml

@@ -8,6 +8,9 @@ on:
 permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
   contents: read
   actions: read
+  # This is used to complete the identity challenge
+  # with sigstore/fulcio when running outside of PRs.
+  id-token: write
 
 jobs:
   call-build-image-auth: