From 296dd793a963ed05ed863c5f1090660974d1fa9e Mon Sep 17 00:00:00 2001 From: Sunrisepeak Date: Sun, 8 Nov 2026 08:51:08 +0900 Subject: [PATCH] ci: a release's CI may read other runs' artifacts, as ci.yml's jobs do Co-authored-by: speak-agent <248744407+speak-agent@users.noreply.github.com> --- .github/workflows/release.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1ef98a8..df2261e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,6 +41,11 @@ jobs: ci: needs: plan uses: ./.github/workflows/ci.yml + # ci.yml's jobs read other runs' artifacts (a plugin borrows the backend main built); a called + # workflow's jobs are granted no more than its caller's job, so this one grants that read. + permissions: + contents: read + actions: read release: needs: [plan, ci]