From 4c4ca253b4d4368e72b153af5bda568ff6e0b9ac Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Thu, 15 Oct 2026 13:18:16 +1000
Subject: [PATCH] fix(ci): grant contents: write only to the release jobs that
 edit the release

The release workflow granted contents: write to every job, including the distro builds and the self-hosted verify job, which only read. Only release, promote, mark-failed and iso create or edit the GitHub release, so they alone get write and the rest default to read.
---
 .github/workflows/release.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2e78834e9..e0688a747 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,7 @@ on:
     tags: [ "v*" ]
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   distro-amd64:
@@ -133,6 +133,8 @@ jobs:
   release:
     needs: [ distro-amd64, distro-arm64 ]
     runs-on: ubuntu-26.04
+    permissions:
+      contents: write
     steps:
       - name: Download amd64 Artifacts
         uses: actions/download-artifact@v8.0.2
@@ -248,6 +250,8 @@ jobs:
   promote:
     needs: [ verify, baremetal ]
     runs-on: ubuntu-26.04
+    permissions:
+      contents: write
     env:
       TAG: ${{ github.ref_name }}
       REPO: ${{ github.repository }}
@@ -280,6 +284,8 @@ jobs:
     needs: [ verify, baremetal ]
     if: failure()
     runs-on: ubuntu-26.04
+    permissions:
+      contents: write
     env:
       TAG: ${{ github.ref_name }}
       REPO: ${{ github.repository }}
@@ -297,6 +303,8 @@ jobs:
   iso:
     needs: release
     runs-on: [ self-hosted, ci-single ]
+    permissions:
+      contents: write
     # ISO build (~60-90m) overlaps the parallel baremetal run (~120m); the
     # upload gate then waits for baremetal to finish, so the job must outlast it.
     timeout-minutes: 180