From 7bf5905ac97316a7896de8cbc12d243f57b09bd8 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 23 Oct 2026 17:28:41 -0400 Subject: [PATCH] security: write the release from the release job only (SonarCloud S8233) (#2021) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workflow-level contents: write granted every job the right to push tags and releases; the reusable release workflow is the only job that needs it. Workflow level drops to read. 🤖 Generated with Codebuff Co-authored-by: Codebuff --- .github/workflows/release.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5f9d5587..6cc35e57 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,7 +11,7 @@ on: default: "" permissions: - contents: write + contents: read concurrency: group: release-${{ github.ref }} @@ -59,6 +59,9 @@ jobs: release: needs: git-sources + permissions: + # The reusable release workflow tags and uploads the draft release. + contents: write # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos. uses: storytold/craft-common-actions/.github/workflows/release.yml@main with: