From eeb039bea6b6aa1959a32f96f7ff00e82ea957d5 Mon Sep 17 00:00:00 2001 From: Benjamin Leggett Date: Fri, 24 Jul 2026 11:58:19 -0400 Subject: [PATCH] fix(ci): scope token --- .github/workflows/release.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index d489453..aa360c7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -43,6 +43,9 @@ jobs: with: app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}" private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}" + # Scope to what release-plz's `release` command needs: create tags + # and GitHub releases. + permission-contents: write - name: Run release-plz uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5 @@ -87,6 +90,10 @@ jobs: with: app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}" private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}" + # Scope to what release-plz's `release-pr` command needs: push the + # release branch (contents) and open/update the PR (pull-requests). + permission-contents: write + permission-pull-requests: write - name: Run release-plz uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5