From 5695bdc88696ac56ac7033949afa1c6e41c5e422 Mon Sep 17 00:00:00 2001 From: woksin Date: Fri, 24 Jul 2026 16:04:52 +0200 Subject: [PATCH] Declare contents: write on the publish workflows The three publish workflows create a GitHub release via cratis/release-action but declared no permissions, relying on the org's default token being writable. Grant contents: write explicitly so release creation does not depend on the default and cannot 403 if it is ever tightened to read-only. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/basedev-mongodb.yml | 4 ++++ .github/workflows/basedev.yml | 4 ++++ .github/workflows/mongodb.yml | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/.github/workflows/basedev-mongodb.yml b/.github/workflows/basedev-mongodb.yml index 492d42c..f493cae 100644 --- a/.github/workflows/basedev-mongodb.yml +++ b/.github/workflows/basedev-mongodb.yml @@ -30,6 +30,10 @@ on: paths: - "BaseDevelopment/MongoDB/**" +# Creating the GitHub release needs a write-capable token. +permissions: + contents: write + jobs: release: runs-on: ubuntu-latest diff --git a/.github/workflows/basedev.yml b/.github/workflows/basedev.yml index 3ced8ad..c5a7d82 100644 --- a/.github/workflows/basedev.yml +++ b/.github/workflows/basedev.yml @@ -30,6 +30,10 @@ on: paths: - "BaseDevelopment/MongoDB/**" +# Creating the GitHub release needs a write-capable token. +permissions: + contents: write + jobs: release: runs-on: ubuntu-latest diff --git a/.github/workflows/mongodb.yml b/.github/workflows/mongodb.yml index ee4e523..23a5e9c 100644 --- a/.github/workflows/mongodb.yml +++ b/.github/workflows/mongodb.yml @@ -30,6 +30,10 @@ on: paths: - "MongoDB/**" +# Creating the GitHub release needs a write-capable token. +permissions: + contents: write + jobs: release: runs-on: ubuntu-latest