From a22efab58436b03ae0c350f69eb5362da7b04eaa Mon Sep 17 00:00:00 2001 From: Divyansh Rawat Date: Mon, 31 Aug 2026 16:29:56 +0530 Subject: [PATCH] ci: scope packages:write to the jobs that need it docker-publish.yml pushes to GHCR with GITHUB_TOKEN, so it needs packages: write, but only in the buildx job. Move it there and leave contents: read at the workflow level. docker-release.yml authenticates to Docker Hub with DOCKERHUB_USERNAME and DOCKERHUB_TOKEN and never touches GHCR, so packages: write grants the GITHUB_TOKEN nothing it uses. Drop it rather than relocate it. Fixes #917 --- .github/workflows/docker-publish.yml | 4 +++- .github/workflows/docker-release.yml | 1 - 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index f82cd1159..f03d5386d 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -11,12 +11,14 @@ on: permissions: contents: read - packages: write jobs: # Push to GHCR on every main branch commit; build-only on PRs buildx: runs-on: ubuntu-latest + permissions: + contents: read + packages: write concurrency: group: ${{ github.workflow }}-${{ github.ref }} steps: diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index bd6aae7b4..bfc61c6ea 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -5,7 +5,6 @@ on: permissions: contents: read - packages: write jobs: # Push to Docker Hub on published releases (non-prerelease only)