From e370e0e0887a39393c7ba469cfc707232e8cd1f6 Mon Sep 17 00:00:00 2001 From: Zac Farrell Date: Wed, 9 Sep 2026 08:32:57 -0700 Subject: [PATCH] fix(ci): scope release.yml write permission to the job Workflow-level `contents: write` granted the token to every job in the workflow. Default to `permissions: {}` and grant `contents: write` only on the release job that creates the GitHub Release. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b141f16..cdf5316 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,13 +11,16 @@ on: required: true type: string -permissions: - contents: write +# Deny everything by default; each job opts into only what it needs. +permissions: {} jobs: release: name: Create GitHub Release runs-on: ubuntu-latest + permissions: + # Required to create the GitHub Release for the tag. + contents: write env: RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }} steps: