From d46eb40f04638b83a2e57bfd41a7b4ffd177da0f Mon Sep 17 00:00:00 2001
From: Rob Cresswell <robcresswell@users.noreply.github.com>
Date: Tue, 19 May 2026 18:31:40 +0000
Subject: [PATCH] docs: add id-token permission to publish examples

`tessl tile publish` reads the GitHub OIDC token for publish
verification, which requires the workflow to declare
`permissions: id-token: write`. Without it GitHub doesn't expose
`ACTIONS_ID_TOKEN_REQUEST_TOKEN` to the job. `contents: read` is
added alongside since declaring any permissions block drops the
default token scopes that `actions/checkout` needs.
---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index 479e1e1..4b1678c 100644
--- a/README.md
+++ b/README.md
@@ -64,6 +64,9 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v6
       - uses: tesslio/setup-tessl@v2
@@ -83,6 +86,9 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     strategy:
       matrix:
         tile: [tiles/auth, tiles/payments, tiles/notifications]