From 9b636d375ac20d3d9e88dfad6e512d52145e6d59 Mon Sep 17 00:00:00 2001 From: Benjamin Leggett Date: Fri, 24 Jul 2026 11:58:19 -0400 Subject: [PATCH] fix(ci): scope token --- .github/workflows/release.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 65e9662..e14de28 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -43,6 +43,9 @@ jobs: with: app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}" private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}" + # Scope to what release-plz's `release` command needs: create tags + # and GitHub releases. + permission-contents: write - name: Run release-plz uses: release-plz/action@b8d6b54b02889ff2ae2bb82e8b57c3a8fc1683a5 # v0.5.139 @@ -87,6 +90,10 @@ jobs: with: app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}" private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}" + # Scope to what release-plz's `release-pr` command needs: push the + # release branch (contents) and open/update the PR (pull-requests). + permission-contents: write + permission-pull-requests: write - name: Run release-plz uses: release-plz/action@b8d6b54b02889ff2ae2bb82e8b57c3a8fc1683a5 # v0.5.139