From b2e26b3eeabac400eb84521ada49fe40b2527205 Mon Sep 17 00:00:00 2001 From: KC Berg Date: Wed, 9 Jul 2025 04:36:52 -0600 Subject: [PATCH 1/2] ci: add contents write permission for GITHUB_TOKEN to enable tag pushes --- .github/workflows/ci.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 98f8090..8f75128 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [ main ] +permissions: + contents: write + jobs: test: runs-on: ubuntu-latest @@ -46,7 +49,7 @@ jobs: git config user.email "${{ secrets.GH_DEPLOY_EMAIL }}" - name: Set up git for pushing run: | - git remote set-url origin https://${{ secrets.GH_DEPLOY_USER }}:${{ secrets.GH_TOKEN }}@github.com/${{ github.repository }}.git + git remote set-url origin https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/${{ github.repository }}.git - name: Show git user and remote run: | git config --get user.name From 44a82622500c8656f2667cf42be0e75f3ac29b98 Mon Sep 17 00:00:00 2001 From: KC Berg Date: Wed, 9 Jul 2025 04:37:40 -0600 Subject: [PATCH 2/2] release: ensure permissions block is present for GITHUB_TOKEN write access --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 85b425d..9b67232 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -58,7 +58,7 @@ jobs: pip install build bumpver - name: Set up git for pushing run: | - git remote set-url origin https://${{ secrets.GH_DEPLOY_USER }}:${{ secrets.GH_TOKEN }}@github.com/${{ github.repository }}.git + git remote set-url origin https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/${{ github.repository }}.git - name: Set git user for deploy run: | git config user.name "${{ secrets.GH_DEPLOY_USER }}"