From 2f3e6a3a7f1adb5a9d9eb40863f230a4ebd96de2 Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Thu, 23 Jul 2026 14:45:59 +0200 Subject: [PATCH 1/3] use restricted app token Signed-off-by: Martijn Govers --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f8e1ce55..2b624488 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -136,6 +136,7 @@ jobs: with: client-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} + repositories: ${{ github.repository }} - name: Release uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 From dcded9b3d84c99257a1f369cb43d2678e50034ca Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Thu, 23 Jul 2026 16:03:52 +0200 Subject: [PATCH 2/3] restrict permissions Signed-off-by: Martijn Govers --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2b624488..9139934a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -137,6 +137,7 @@ jobs: client-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} + permissions-contents: write - name: Release uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 From 4e213cfc1438e3a0c5ed799405505a4bb16e2b3b Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Fri, 24 Jul 2026 11:10:30 +0200 Subject: [PATCH 3/3] Apply suggestion from @mgovers Signed-off-by: Martijn Govers Signed-off-by: Martijn Govers --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9139934a..c78d199b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -137,7 +137,7 @@ jobs: client-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} - permissions-contents: write + permission-contents: write - name: Release uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2