From 3e74fdfa77e8299e18fef3eeb170ff6019e20216 Mon Sep 17 00:00:00 2001 From: Korinne Adler Date: Tue, 29 Sep 2026 12:29:38 -0500 Subject: [PATCH] ci: Add explicit workflow permissions --- .github/workflows/build.yml | 3 +++ .github/workflows/create-release.yml | 9 +++++---- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d11e256..67e6881 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -2,6 +2,9 @@ name: Build on: pull_request +permissions: + contents: read + jobs: build-matrix: strategy: diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 25a2571..1acd9cc 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -4,12 +4,10 @@ on: push: tags: ["v*"] -permissions: - id-token: write # Required for OIDC - contents: write # Required for action-gh-release - jobs: build-matrix: + permissions: + contents: read strategy: matrix: node-version: @@ -58,6 +56,9 @@ jobs: path: build/stage/*.tar.gz create-release: + permissions: + id-token: write # Required for OIDC + contents: write # Required for action-gh-release runs-on: ubuntu-latest needs: build-matrix steps: