From 7100d7c57de8c56dc277da0407cc9d11ca65f353 Mon Sep 17 00:00:00 2001 From: Arjun Raja Yogidas Date: Thu, 16 Oct 2025 21:28:48 +0000 Subject: [PATCH] fix: ci permissions block for release-please Signed-off-by: Arjun Raja Yogidas --- .github/workflows/release-automation.yaml | 2 +- .github/workflows/release-please.yaml | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-automation.yaml b/.github/workflows/release-automation.yaml index 1ab83738..e2d1c5c2 100644 --- a/.github/workflows/release-automation.yaml +++ b/.github/workflows/release-automation.yaml @@ -62,7 +62,7 @@ jobs: # This is required for configure-aws-credentials to request an OIDC JWT ID token to access AWS resources later on. # More info: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings id-token: write - contents: read # this is required for actions/checkout + contents: write # this is required for actions/checkout secrets: inherit with: ref_name: ${{ needs.get-latest-tag.outputs.tag }} diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index e4cacc04..785fcc4a 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -6,7 +6,7 @@ on: name: release-please permissions: - contents: read + contents: write # Required for trigger-release-automation job pull-requests: write jobs: @@ -25,4 +25,7 @@ jobs: name: Trigger release-automation.yaml if PR is merged needs: [release-please] if: ${{ needs.release-please.outputs.release_created == 'true' }} + permissions: + contents: write # Required for uploading release assets + id-token: write # Required for AWS OIDC authentication uses: ./.github/workflows/release-automation.yaml