From 341dc03fdc047eea39ae4a56567f56b167d9ec2b Mon Sep 17 00:00:00 2001 From: unional Date: Thu, 20 Aug 2026 01:04:14 -0700 Subject: [PATCH] fix(ci): grant the release caller the scopes the shared workflow declares MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pinning to @v2 also moved to the workflow that runs changesets/action v2, which pushes release commits and tags through the GitHub API and so declares contents: write and pull-requests: write. release.yml granted id-token: write and contents: read, and declaring permissions at all drops every unlisted scope to none — a callee asking for more than the caller holds fails the run at startup, which is what main is doing now. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c6b2db73..c1849b16 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -53,6 +53,13 @@ jobs: */*/__vis__/**/__results__ release: + # Declaring permissions replaces the default set, so every scope the called + # workflow declares must be listed here — unlisted ones drop to none, and a + # callee asking for more than the caller holds fails the run at startup. + permissions: + id-token: write + contents: write + pull-requests: write uses: repobuddy/.github/.github/workflows/pnpm-release-changeset.yml@v2 needs: verify secrets: inherit