From ac085e56e8db3867d8eb4dc82f0aabe73b911eb0 Mon Sep 17 00:00:00 2001 From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:48:25 +0200 Subject: [PATCH 1/3] fix(release-please): set explicit token permissions --- .github/workflows/release-please.yml | 3 +++ release-please/workflow-sha256 | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index c382491..ae4e499 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -23,6 +23,9 @@ jobs: with: client-id: "${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}" private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }} + permission-contents: write + permission-issues: write + permission-pull-requests: write - name: Run release-please uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 with: diff --git a/release-please/workflow-sha256 b/release-please/workflow-sha256 index f8ddc67..1aa3f58 100644 --- a/release-please/workflow-sha256 +++ b/release-please/workflow-sha256 @@ -1 +1 @@ -1d9d54064d8a10354bfc6a5429a13770b9e185c82fb0a116ed2abc3ceb8dbbf7 +c3c32559203941cdfb33bd983e5178a3284c8035aec0ff05163ab7b9533edc77 From 58010679a6c80d88783e503091f5eaaf43f872d7 Mon Sep 17 00:00:00 2001 From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com> Date: Mon, 5 Oct 2026 15:31:11 +0200 Subject: [PATCH 2/3] chore: remove useless permissions from GITHUB_TOKEN (permissions are carried by the install token from the app) --- .github/workflows/release-please.yml | 5 +---- release-please/workflow-sha256 | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index ae4e499..89f35ce 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -8,10 +8,7 @@ on: RELEASE_PLEASE_PRIVATE_KEY: required: true -permissions: - contents: write - issues: write - pull-requests: write +permissions: {} jobs: release-please: diff --git a/release-please/workflow-sha256 b/release-please/workflow-sha256 index 1aa3f58..2586be3 100644 --- a/release-please/workflow-sha256 +++ b/release-please/workflow-sha256 @@ -1 +1 @@ -c3c32559203941cdfb33bd983e5178a3284c8035aec0ff05163ab7b9533edc77 +92300e2292f4c1e2431a1313c968f2a96b91dd320dea13f2586ddd0c570fadbe From 9f75b3a6edc396152de619a7ef3a8ae8108da779 Mon Sep 17 00:00:00 2001 From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com> Date: Mon, 5 Oct 2026 15:39:52 +0200 Subject: [PATCH 3/3] docs: explain token scope --- release-please/README.md | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/release-please/README.md b/release-please/README.md index 493ea8c..e49757c 100644 --- a/release-please/README.md +++ b/release-please/README.md @@ -62,7 +62,7 @@ _Or with predefined versions:_ ## 2. ⚙️ Usage in Your Repository -Place the following YAML file (e.g., `.github/workflows/release.yml`) in your repository to directly call the reusable workflow. It triggers the workflow on a push to the `main` branch, applies the necessary permissions, and inherits secrets. +Place the following YAML file (e.g., `.github/workflows/release.yml`) in your repository to directly call the reusable workflow. It triggers the workflow on a push to the `main` branch and inherits secrets. No `GITHUB_TOKEN` permission is needed (see [2.1. Token Scope](#21-token-scope)). ```yaml on: @@ -70,10 +70,7 @@ on: branches: - main -permissions: - contents: write - issues: write - pull-requests: write +permissions: {} name: release-please @@ -83,6 +80,26 @@ jobs: secrets: inherit ``` +### 2.1. Token Scope + +The workflow does not use the `GITHUB_TOKEN`. It authenticates as a GitHub App with the `RELEASE_PLEASE_APPLICATION_ID` and `RELEASE_PLEASE_PRIVATE_KEY` secrets, because [events created with the `GITHUB_TOKEN` do not trigger new workflow runs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow): CI would not run on release PRs, and release tags would not trigger publish workflows. + +The App installation token is: + +- **Short-lived:** + It expires after one hour. + +- **Limited to the calling repository:** + It only grants access to the repository running the workflow. + +- **Restricted to the permissions release-please needs:** + Even if the App itself is granted more, the token only carries: + - `contents: write` to push the release branch and create tags and releases; + - `pull-requests: write` to open and update the release PR; + - `issues: write` to label and comment on the release PR. + +The App must be granted at least these permissions on the repository. + ## 3. Release Types **release-please** supports different release types tailored for various ecosystems and languages via the `release-type` parameter in the configuration file. Here are some of the common ones: