From 7e425c6c106d5e756042230d5dd0b49d4bb036c3 Mon Sep 17 00:00:00 2001 From: Patryk Bujna Date: Mon, 20 Jul 2026 13:09:03 +0200 Subject: [PATCH 1/2] Grant explicit token permissions to release.yml caller job --- .github/workflows/release.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0a681a7..ae5bc01 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,6 +23,11 @@ jobs: release: needs: version + # Explicit token grant: the repo default is read-only, and a reusable + # workflow cannot exceed the caller's grant. release.yml creates a GitHub + # Release, which needs contents: write. + permissions: + contents: write # Pinned to @main for now; repin to a released tag (e.g. @v1) once one is cut. uses: apius-tech/splunk-app-ci/.github/workflows/release.yml@main with: From 6b8e4a25e065f3ed4f5b610ffe9ea3a965842ff1 Mon Sep 17 00:00:00 2001 From: Patryk Bujna Date: Mon, 20 Jul 2026 13:09:04 +0200 Subject: [PATCH 2/2] Grant explicit token permissions to prepare-release.yml caller job --- .github/workflows/prepare-release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index aea7d50..c8ebd6c 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -17,6 +17,12 @@ on: jobs: prepare-release: + # Explicit token grant: the repo default is read-only, and a reusable + # workflow cannot exceed the caller's grant. prepare-release.yml opens a + # version-bump PR, which needs contents: write + pull-requests: write. + permissions: + contents: write + pull-requests: write # Pinned to @main for now; repin to a released tag (e.g. @v1) once one is cut. uses: apius-tech/splunk-app-ci/.github/workflows/prepare-release.yml@main with: