From 6018520e9c94cb5741d554217643800f8f6b5185 Mon Sep 17 00:00:00 2001 From: BinFlip Date: Sun, 9 Aug 2026 20:43:32 -0700 Subject: [PATCH] ci: grant the CLI build job permission to upload release assets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Attaching the built binaries failed with "HTTP 403: Resource not accessible by integration". The job uploads through GITHUB_TOKEN but declares no permissions block, so it inherits the default — and the default here is read-only. Grant `contents: write` on that job alone rather than raising the default for every workflow, so the elevated permission is scoped to the step that needs it. --- .github/workflows/release.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2d8f63f8..1854d174 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -96,6 +96,13 @@ jobs: name: Build CLI (${{ matrix.name }}) runs-on: ${{ matrix.os }} needs: [version, test] + + # Needed to attach the built binaries to the release. The default + # GITHUB_TOKEN permission is read-only, which makes the upload fail with + # "Resource not accessible by integration". + permissions: + contents: write + strategy: fail-fast: false matrix: