From b4e540decc484bd22eb84484a8eb94f19b1790c1 Mon Sep 17 00:00:00 2001 From: Brandy Smith Date: Mon, 1 Dec 2025 10:10:00 -0500 Subject: [PATCH 1/2] chore(workflows): update release workflow permissions for finalizing (#30814) Co-authored-by: Brandy Smith <6577830+brandyscarney@users.noreply.github.com> --- .github/workflows/release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6fcb4b7d5d..96640319e5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,6 +54,9 @@ jobs: finalize-release: needs: [release-ionic] runs-on: ubuntu-latest + permissions: + contents: write + id-token: write steps: - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 with: @@ -82,6 +85,9 @@ jobs: # possible for them to push at the same time. needs: [finalize-release] runs-on: ubuntu-latest + permissions: + contents: write + id-token: write steps: - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 # Pull the latest version of the reference From c65b76e72777bff11612c972fa087fba9081572c Mon Sep 17 00:00:00 2001 From: Brandy Smith Date: Mon, 1 Dec 2025 11:25:26 -0500 Subject: [PATCH 2/2] chore(workflows): fix release workflow permissions (#30823) The workflow permissions update did not work due to it being nested in a workflow that only had `read` permissions. You can see a failing run here (scroll down to annotations): [19828029833](https://github.com/ionic-team/ionic-framework/actions/runs/19828029833) ``` Invalid workflow file: .github/workflows/release-orchestrator.yml#L71 The workflow is not valid. .github/workflows/release-orchestrator.yml (Line: 71, Col: 3): Error calling workflow 'ionic-team/ionic-framework/.github/workflows/release.yml@b4e540decc484bd22eb84484a8eb94f19b1790c1'. The nested job 'finalize-release' is requesting 'contents: write', but is only allowed 'contents: read'. .github/workflows/release-orchestrator.yml (Line: 71, Col: 3): Error calling workflow 'ionic-team/ionic-framework/.github/workflows/release.yml@b4e540decc484bd22eb84484a8eb94f19b1790c1'. The nested job 'update-package-lock' is requesting 'contents: write', but is only allowed 'contents: read'. ``` This updates the parent workflow to have `write` permissions. You can see a passing run here: [19828895682](https://github.com/ionic-team/ionic-framework/actions/runs/19828895682) Co-authored-by: Brandy Smith <6577830+brandyscarney@users.noreply.github.com> --- .github/workflows/release-orchestrator.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-orchestrator.yml b/.github/workflows/release-orchestrator.yml index 2c41ed516f..a0c05cbcd5 100644 --- a/.github/workflows/release-orchestrator.yml +++ b/.github/workflows/release-orchestrator.yml @@ -71,7 +71,7 @@ jobs: run-production: if: ${{ github.event_name == 'workflow_dispatch' && inputs.release-type == 'production' }} permissions: - contents: read + contents: write id-token: write uses: ./.github/workflows/release.yml secrets: inherit