From 54dd2b22249f3d3fbd05f8b42f6bc7c6e33448bd Mon Sep 17 00:00:00 2001 From: Andres Cera Date: Fri, 12 Jun 2026 05:56:20 -0500 Subject: [PATCH] ci(release): grant contents:write to the publish job Create GitHub Release failed with 403 "Resource not accessible by integration" because the workflow has no permissions block and inherits the repo's read-only default GITHUB_TOKEN. Scope contents:write to the sign-and-publish job (least privilege) so softprops/action-gh-release can create the tag and release. How to verify: dispatch Publish Release (stable); Create GitHub Release publishes v2026.6.0 with the .deb + checksum assets. --- .github/workflows/publish-release.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index da7b3ea..6a4d9e3 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -139,6 +139,8 @@ jobs: name: Sign and Publish to R2 needs: [calculate-version, build-deb] runs-on: ubuntu-latest + permissions: + contents: write steps: - name: Download all artifacts uses: actions/download-artifact@v4