Allow callers to control workflow permissions

2026-01-06 20:32:29 +00:00
parent ac8dfcc607
commit fa308696b4
1 changed files with 2 additions and 3 deletions
--- a/.github/workflows/build-and-upload.yml
+++ b/.github/workflows/build-and-upload.yml
@@ -29,9 +29,8 @@ on:
        default: true
        type: boolean

-permissions:
-  id-token: write
-  contents: write
+# Permissions are intentionally omitted here so callers can choose
+# least-privilege (e.g. dev CI uses read-only; releases grant write).

 env:
  NODE_VERSION: 20