From 876939346cd5c813e7e18b213265b005f4d8887c Mon Sep 17 00:00:00 2001
From: jan-kubica <jankubica@protonmail.com>
Date: Tue, 11 Aug 2026 13:44:54 +0200
Subject: [PATCH 1/2] fix: grant release artifact access

---
 .github/workflows/publish.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 79f5d20..06ff45f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -85,6 +85,7 @@ jobs:
       github.ref == 'refs/heads/main'
       && (github.event_name == 'push' || inputs.publish_to_npm)
     permissions:
+      actions: read
       contents: write
       id-token: write
     # Keep this caller filename stable: npm trusted publishing authorizes it.

From 93d72fbff1bccbb4748e209981cbf777e6ed13d2 Mon Sep 17 00:00:00 2001
From: jan-kubica <jankubica@protonmail.com>
Date: Tue, 11 Aug 2026 13:45:34 +0200
Subject: [PATCH 2/2] test: guard release artifact permissions

---
 scripts/bun-lock-workspace-versions.test.ts | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/scripts/bun-lock-workspace-versions.test.ts b/scripts/bun-lock-workspace-versions.test.ts
index 061d9c3..68c5a47 100644
--- a/scripts/bun-lock-workspace-versions.test.ts
+++ b/scripts/bun-lock-workspace-versions.test.ts
@@ -78,9 +78,27 @@ describe("bun.lock workspace self-version synchronization", () => {
       publishWorkflow.indexOf("  workflow_dispatch:"),
     );
 
-    for (const packageName of ["typescript-config", "oxlint-config"]) {
+    for (const packageName of [
+      "typescript-config",
+      "oxlint-config",
+      "oxlint-plugin",
+    ]) {
       expect(pushTrigger).toContain(`packages/${packageName}/CHANGELOG.md`);
       expect(pushTrigger).not.toContain(`packages/${packageName}/package.json`);
     }
   });
+
+  test("release caller can verify and download package artifacts", async () => {
+    const publishWorkflow = await Bun.file(
+      new URL("../.github/workflows/publish.yml", import.meta.url),
+    ).text();
+    const releaseJob = publishWorkflow.slice(
+      publishWorkflow.indexOf("  release:"),
+    );
+
+    expect(releaseJob).toContain("actions: read");
+    expect(releaseJob.indexOf("actions: read")).toBeLessThan(
+      releaseJob.indexOf("uses: stella/.github/"),
+    );
+  });
 });