From ece27630c7eda67e022ad8c290618aaee0dce59c Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Thu, 23 Jul 2026 14:21:43 +0200 Subject: [PATCH 1/4] use restricted app tokens Signed-off-by: Martijn Govers --- .github/workflows/ci.yml | 1 + .github/workflows/refresh-lock-and-linter-dependencies.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 11635aae2e..2b7be125f8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -78,6 +78,7 @@ jobs: with: client-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} + repositories: ${{ github.repository }} - name: Create GitHub release uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 diff --git a/.github/workflows/refresh-lock-and-linter-dependencies.yml b/.github/workflows/refresh-lock-and-linter-dependencies.yml index 780ab923c4..195819ea72 100644 --- a/.github/workflows/refresh-lock-and-linter-dependencies.yml +++ b/.github/workflows/refresh-lock-and-linter-dependencies.yml @@ -111,6 +111,7 @@ jobs: with: client-id: ${{ secrets.CI_BOT_APP_ID }} private-key: ${{ secrets.CI_BOT_PRIVATE_KEY }} + repositories: ${{ github.repository }} - name: create pull request if: ${{ inputs.create-pr || github.event_name == 'schedule' }} From c98cdf24e5cb69325d57dc84889a4496804ff4f2 Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Thu, 23 Jul 2026 16:01:06 +0200 Subject: [PATCH 2/4] set app token permissions Signed-off-by: Martijn Govers --- .github/workflows/ci.yml | 1 + .github/workflows/refresh-lock-and-linter-dependencies.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2b7be125f8..42f5cab94c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -79,6 +79,7 @@ jobs: client-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} + permissions-contents: write - name: Create GitHub release uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 diff --git a/.github/workflows/refresh-lock-and-linter-dependencies.yml b/.github/workflows/refresh-lock-and-linter-dependencies.yml index 195819ea72..ca7357dfa2 100644 --- a/.github/workflows/refresh-lock-and-linter-dependencies.yml +++ b/.github/workflows/refresh-lock-and-linter-dependencies.yml @@ -112,6 +112,7 @@ jobs: client-id: ${{ secrets.CI_BOT_APP_ID }} private-key: ${{ secrets.CI_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} + permissions-pull-requests: write - name: create pull request if: ${{ inputs.create-pr || github.event_name == 'schedule' }} From 6af15cbf474b75f452c91816080021cab3d8ed67 Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Fri, 24 Jul 2026 11:05:04 +0200 Subject: [PATCH 3/4] fix typo Signed-off-by: Martijn Govers --- .github/workflows/ci.yml | 2 +- .github/workflows/refresh-lock-and-linter-dependencies.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 42f5cab94c..1dc7f16a60 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -79,7 +79,7 @@ jobs: client-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} - permissions-contents: write + permission-contents: write - name: Create GitHub release uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 diff --git a/.github/workflows/refresh-lock-and-linter-dependencies.yml b/.github/workflows/refresh-lock-and-linter-dependencies.yml index ca7357dfa2..842cb509f7 100644 --- a/.github/workflows/refresh-lock-and-linter-dependencies.yml +++ b/.github/workflows/refresh-lock-and-linter-dependencies.yml @@ -112,7 +112,7 @@ jobs: client-id: ${{ secrets.CI_BOT_APP_ID }} private-key: ${{ secrets.CI_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} - permissions-pull-requests: write + permission-pull-requests: write - name: create pull request if: ${{ inputs.create-pr || github.event_name == 'schedule' }} From a09d0dcaf71e956b0df121f8173dc005ef819055 Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Fri, 24 Jul 2026 11:07:54 +0200 Subject: [PATCH 4/4] add all permissions correctly Signed-off-by: Martijn Govers --- .github/workflows/refresh-lock-and-linter-dependencies.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/refresh-lock-and-linter-dependencies.yml b/.github/workflows/refresh-lock-and-linter-dependencies.yml index 842cb509f7..e9dc2cc14f 100644 --- a/.github/workflows/refresh-lock-and-linter-dependencies.yml +++ b/.github/workflows/refresh-lock-and-linter-dependencies.yml @@ -112,6 +112,7 @@ jobs: client-id: ${{ secrets.CI_BOT_APP_ID }} private-key: ${{ secrets.CI_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} + permission-contents: write permission-pull-requests: write - name: create pull request