fix: propagate content read for release integration (#506)

reggi · web-flow · commit fa962c3b6761 · 2025-03-05T12:21:05.000-08:00
diff --git a/.github/workflows/release-integration.yml b/.github/workflows/release-integration.yml
@@ -21,6 +21,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -244,6 +244,7 @@ jobs:
     if: needs.release.outputs.releases
     uses: ./.github/workflows/release-integration.yml
     permissions:
+      contents: read
       id-token: write
     secrets:
       PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
diff --git a/lib/content/release-integration-yml.hbs b/lib/content/release-integration-yml.hbs
@@ -21,6 +21,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
diff --git a/lib/content/release-yml.hbs b/lib/content/release-yml.hbs
@@ -186,6 +186,7 @@ jobs:
     uses: ./.github/workflows/release-integration.yml
     {{#if publish}}
     permissions:
+      contents: read
       id-token: write
     secrets:
       PUBLISH_TOKEN: $\{{ secrets.PUBLISH_TOKEN }}
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -890,6 +890,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
@@ -2574,6 +2575,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
@@ -4114,6 +4116,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
