From 1c00ae34925e5c4d389fc4774553bf6990bfb7ba Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 23 Oct 2026 17:16:13 -0400 Subject: [PATCH] security: write the release from the release job only (SonarCloud S8233) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workflow-level contents: write granted every job the right to push tags and releases; the reusable release workflow is the only job that needs it. Workflow level drops to read. 🤖 Generated with Codebuff Co-Authored-By: Codebuff --- .github/workflows/release.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5f9d55879..6cc35e572 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,7 +11,7 @@ on: default: "" permissions: - contents: write + contents: read concurrency: group: release-${{ github.ref }} @@ -59,6 +59,9 @@ jobs: release: needs: git-sources + permissions: + # The reusable release workflow tags and uploads the draft release. + contents: write # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos. uses: storytold/craft-common-actions/.github/workflows/release.yml@main with: